This threat introduces a new way for malware writers to abuse the default packaging functionality: instead of placing a malicious payload in preinstall or postinstall scripts, malware writers hid one in the Distribution XML file. According to a RedCanary report, a new threat called Silver Sparrow has been identified. XCSSET is not the only family which has adapted to run natively on Apple Silicon. This leads us to the thought that more and more malware writers are actively recompiling their samples to have an opportunity to run on new Apple Silicon Macs natively. With this information on hand, we can assume that the XCSSET campaign is probably still ongoing. According to VirusTotal, this sample was first uploaded on 21:06:05 and the original research report did not contain this hash or a module named “metald”, the name of the executable file. The first one corresponds to previous-generation, Intel-based Mac computers, but the second one is compiled for ARM64 architecture, which means that it can run on computers with the new Apple M1 chip. For example, a sample with the MD5 hash sum 914e49921c19fffd7443deee6ee161a4 contains two architectures: x86_64 and ARM64. While exploring the various executable modules of XCSSET, we found out that some of them also contained samples compiled specially for new Apple Silicon chips. Stealing user files and information from applications, such as Notes, WeChat, Skype, Telegram, etc.,Īll these various features, in combination with high stealth and an unusual way of distribution, make XCSSET a dangerous threat for Mac computers.Injecting malicious JavaScript code into various websites,.XCSSET modules have numerous capabilities, such as: This payload will be executed at the time of building project files in Xcode. It targets mainly Mac developers using a unique way of distribution: injecting a malicious payload into Xcode IDE projects on the victim’s Mac. Last year, a threat called XCSSET was discovered for the first time. section at the end of the article for those who want to understand better the security risks of M1 malware.
In this article, we are going to take a look at threats for Macs with the Apple M1 chip on board. This inevitably leads us to new malware samples compiled for the Apple Silicon platform. However, as technology evolves, we also observe a growing interest in the newly released platform from malware adversaries. The unexpected release was a milestone in the Apple hardware industry. A short while ago, Apple released Mac computers with the new chip called Apple M1.
0 kommentar(er)
