S0658: XCSSET

S0658: XCSSET describes [XCSSET](https://attack.mitre.org/software/S0658) is a modular macOS malware family delivered through infected Xcode projects and executed when the project is compiled. Active since August 2020, it has been observed installing backdoors, spoofed browsers, collecting data, and encrypting user files. It is composed of SHC-compiled shell scripts and run-only AppleScripts, often hiding in apps that mimic system tools (such as Xcode, Mail, or Notes) or use familiar icons (like Launchpad) to avoid detection.(Citation: tr...

Executive priority

S0658: XCSSET is an official MITRE ATT&CK software. Glexia treats it as defensive behavior context for prioritizing monitoring, control validation, and response planning without using the object by itself as an attribution claim.

Technical view

Security teams should validate S0658: XCSSET by reviewing the official ATT&CK relationships, mapped tactics (the mapped ATT&CK tactic context), supported platforms (macOS), and available local telemetry before making detection or mitigation decisions.

Likely telemetry

Official ATT&CK relationships and object metadata
Network, endpoint, and security-tool telemetry

Detection direction

Validate whether S0658: XCSSET appears in your detection coverage and tabletop scenarios.
Use the object to align executive risk language with SOC, incident response, and detection engineering work.
Do not treat ATT&CK relationship context as attribution without corroborating evidence.

Mitigation priorities

Map the object to existing controls and identify missing telemetry or response ownership.
Prioritize mitigations that reduce exposure on the listed platforms and tactics.
Review adjacent ATT&CK relationships before changing policy, detections, or reporting language.

Additional notes and limits

Baseline Glexia take generated from the official MITRE ATT&CK STIX object, source hash, tactics, platforms, and detection fields. It is safe to replace with a richer model-generated take for the same source hash later.

This baseline take is source-grounded and schema-validated, but it does not include environment-specific telemetry, incident evidence, or threat-intelligence corroboration.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

XCSSET

XCSSET is a modular macOS malware family delivered through infected Xcode projects and executed when the project is compiled. Active since August 2020, it has been observed installing backdoors, spoofed browsers, collecting data, and encrypting user files. It is composed of SHC-compiled shell scripts and run-only AppleScripts, often hiding in apps that mimic system tools (such as Xcode, Mail, or Notes) or use familiar icons (like Launchpad) to avoid detection.[1][2][3]

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Techniques used

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

Filter related techniques33 rows

Domain	ID	Name	Relationship / procedure
Enterprise	T1564.001	Hidden Files and DirectoriesSub-technique	XCSSET uses a hidden folder named `.xcassets` and `.git` to embed itself in Xcode.[1]
Enterprise	T1518	Software Discovery	XCSSET uses `ps aux` with the `grep` command to enumerate common browsers and system processes potentially impacting XCSSET's exfiltration capabilities.[1]
Enterprise	T1614.001	System Language DiscoverySub-technique	XCSSET uses AppleScript to check the host's language and location with the command `user locale of (get system info)`.[1]
Enterprise	T1105	Ingress Tool Transfer	XCSSET downloads browser specific AppleScript modules using a constructed URL with the `curl` command, `https://" & domain & "/agent/scripts/" & moduleName & ".applescript`.[1]
Enterprise	T1041	Exfiltration Over C2 Channel	XCSSET retrieves files that match the pattern defined in the INAME_QUERY variable within the user's home directory, such as `*test.txt`, and are below a specific size limit. It then archives the files and exfiltrates the data over its C2 channel.[1][3]
Enterprise	T1553.001	Gatekeeper BypassSub-technique	XCSSET has dropped a malicious applet into an app's `.../Contents/MacOS/` folder of a previously launched app to bypass Gatekeeper's security checks on first launch apps (prior to macOS 13).CitationApplication Bundle Manipulation Brandon Dalton
Enterprise	T1036	Masquerading	XCSSET installs malicious application bundles that mimic native macOS apps, such as Safari, by using the legitimate app’s icon and customizing the `Info.plist` to match expected metadata.[1][3]
Enterprise	T1195.001	Compromise Software Dependencies and Development ToolsSub-technique	XCSSET adds malicious code to a host's Xcode projects by enumerating CocoaPods `target_integrator.rb` files under the `/Library/Ruby/Gems` folder or enumerates all `.xcodeproj` folders under a given directory. XCSSET then downloads a script and Mach-O file into the Xcode project folder.[1]
Enterprise	T1098.004	SSH Authorized KeysSub-technique	XCSSET will create an ssh key if necessary with the `ssh-keygen -t rsa -f $HOME/.ssh/id_rsa -P` command. XCSSET will upload a private key file to the server to remotely access the host without a password.[1]
Enterprise	T1005	Data from Local System	XCSSET collects contacts and application data from files in Desktop, Documents, Downloads, Dropbox, and WeChat folders.[1]
Enterprise	T1573.001	Symmetric CryptographySub-technique	XCSSET uses RC4 encryption over TCP to communicate with its C2 server.[1]
Enterprise	T1574.006	Dynamic Linker HijackingSub-technique	XCSSET adds malicious file paths to the `DYLD_FRAMEWORK_PATH` and `DYLD_LIBRARY_PATH` environment variables to execute malicious code.[1]
Enterprise	T1560	Archive Collected Data	XCSSET will compress entire `~/Desktop` folders excluding all `.git` folders, but only if the total data size is under 200MB.[1]
Enterprise	T1548.006	TCC ManipulationSub-technique	For several modules, XCSSET attempts to access or list the contents of user folders such as Desktop, Downloads, and Documents. If the folder does not exist or access is denied, it enters a loop where it resets the TCC database and retries access.[3]
Enterprise	T1222.002	Linux and Mac PermissionsSub-technique	XCSSET uses the `chmod +x` command to grant executable permissions to the malicious file.Citation20 macOS Common Tools and Techniques
Enterprise	T1539	Steal Web Session Cookie	XCSSET uses `scp` to access the `~/Library/Cookies/Cookies.binarycookies` file.[1]
Enterprise	T1056.002	GUI Input CaptureSub-technique	XCSSET prompts the user to input credentials using a native macOS dialog box leveraging the system process `/Applications/Safari.app/Contents/MacOS/SafariForWebKitDevelopment`.[1]
Enterprise	T1068	Exploitation for Privilege Escalation	XCSSET has used a zero-day exploit in the ssh launchdaemon to elevate privileges and bypass SIP.[1]
Enterprise	T1569.001	LaunchctlSub-technique	XCSSET loads a system level launchdaemon using the `launchctl load -w` command from `/System/Librarby/LaunchDaemons/ssh.plist`.[1]
Enterprise	T1518.001	Security Software DiscoverySub-technique	XCSSET searches firewall configuration files located in `/Library/Preferences/` and uses `csrutil status` to determine if System Integrity Protection is enabled.[1]
Enterprise	T1486	Data Encrypted for Impact	XCSSET performs AES-CBC encryption on files under `~/Documents`, `~/Downloads`, and `~/Desktop` with a fixed key and renames files to give them a `.enc` extension. Only files with sizes less than 500MB are encrypted.[1]
Enterprise	T1082	System Information Discovery	XCSSET identifies the macOS version and uses `ioreg` to determine serial number.[1]
Enterprise	T1543.004	Launch DaemonSub-technique	XCSSET uses the ssh launchdaemon to elevate privileges, bypass system controls, and enable remote access to the victim.[1]
Enterprise	T1647	Plist File Modification	In older versions, XCSSET uses the `plutil` command to modify the `LSUIElement`, `DFBundleDisplayName`, and `CFBundleIdentifier` keys in the `/Contents/Info.plist` file to change how XCSSET is visible on the system. In later versions, XCSSET leverages a third-party notarized `dockutil` tool to modify the `.plist` file responsible for presenting applications to the user in the Dock and LaunchPad to point to a malicious application.[1][3]
Enterprise	T1027.013	Encrypted/Encoded FileSub-technique	Older XCSSET variants use `xxd` to encode modules. Later versions pass an `xxd` or `base64` encoded blob through multiple decoding stages to reconstruct the module name, AppleScript, or shell command. For example, the initial network request uses three layers of hex decoding before executing a curl command in a shell.[3]
Enterprise	T1083	File and Directory Discovery	XCSSET has used `mdfind` to enumerate a list of apps known to grant screen sharing permissions and leverages a module to run the command `ls -la ~/Desktop`.CitationApplication Bundle Manipulation Brandon Dalton[3]
Enterprise	T1059.004	Unix ShellSub-technique	XCSSET uses a shell script to execute Mach-o files and `osacompile` commands such as, `osacompile -x -o xcode.app main.applescript`.[1]
Enterprise	T1497.003	Time Based ChecksSub-technique	Using the machine's local time, XCSSET waits 43200 seconds (12 hours) from the initial creation timestamp of a specific file, `.report`. After the elapsed time, XCSSET executes additional modules.[1]
Enterprise	T1554	Compromise Host Software Binary	XCSSET uses a malicious browser application to replace the legitimate browser in order to continuously capture credentials, monitor web traffic, and download additional modules.[1]
Enterprise	T1087	Account Discovery	XCSSET attempts to discover accounts from various locations such as a user's Evernote, AppleID, Telegram, Skype, and WeChat data.[1]
Enterprise	T1113	Screen Capture	XCSSET saves a screen capture of the victim's system with a numbered filename and `.jpg` extension. Screen captures are taken at specified intervals based on the system. [1]
Enterprise	T1546.004	Unix Shell Configuration ModificationSub-technique	Using AppleScript, XCSSET adds it's executable to the user's `~/.zshrc_aliases` file (`"echo " & payload & " > ~/zshrc_aliases"`), it then adds a line to the .zshrc file to source the `.zshrc_aliases` file (`[ -f $HOME/.zshrc_aliases ] && . $HOME/.zshrc_aliases`). Each time the user starts a new `zsh` terminal session, the `.zshrc` file executes the `.zshrc_aliases` file.[3]
Enterprise	T1546	Event Triggered Execution	XCSSET's `dfhsebxzod` module searches for `.xcodeproj` directories within the user’s home folder and subdirectories. For each match, it locates the corresponding `project.pbxproj` file and embeds an encoded payload into a build rule, target configuration, or project setting. The payload is later executed during the build process.[3][2]

Relationship explorer

All related ATT&CK context

Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release: 19.2
Object version: 1.3
Created: Oct 5, 2021, 21:58 UTC (UTC+00:00)
Modified: Apr 4, 2025, 17:39 UTC (UTC+00:00)
Raw hash: a2854be8c3f5932a...

Imported snapshots across ATT&CK releases(2)

Release	Bundle imported	Object version	Modified	Status	Raw hash
19.2	Aug 6, 2026, 02:58 UTC (UTC+00:00)	1.3	Apr 4, 2025, 17:39 UTC (UTC+00:00)	Current bundle	`a2854be8c3f5…`
19.1	Jul 14, 2026, 09:14 UTC (UTC+00:00)	1.3	Apr 4, 2025, 17:39 UTC (UTC+00:00)	Older bundle	`a2854be8c3f5…`

Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSON Open MITRE-hosted copy

Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

[1]
trendmicro xcsset xcode project 2020
Mac Threat Response, Mobile Research Team. (2020, August 13). The XCSSET Malware: Inserts Malicious Code Into Xcode Projects, Performs UXSS Backdoor Planting in Safari, and Leverages Two Zero-day Exploits. Retrieved October 5, 2021.
Open source URL
[2]
April 2021 TrendMicro XCSSET
Steven Du, Dechao Zhao, Luis Magisa, Ariel Neimond Lazaro. (2021, April 16). XCSSET Quickly Adapts to macOS 11 and M1-based Macs. Retrieved February 18, 2025.
Open source URL
[3]
Microsoft March 2025 XCSSET
Microsoft Threat Intelligence. (2025, March 11). New XCSSET malware adds new obfuscation, persistence techniques to infect Xcode projects. Retrieved April 2, 2025.
Open source URL
[4]
OSX.DubRobber
(Citation: malwarebyteslabs xcsset dubrobber)
[5]
XCSSET
(Citation: trendmicro xcsset xcode project 2020)
[6]
malwarebyteslabs xcsset dubrobber
Thomas Reed. (2020, April 21). OSX.DubRobber. Retrieved October 5, 2021.
Open source URL
[7]
mitre-attackS0658
Open source URL

Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK site Official STIX data repository MITRE ATT&CK terms of use