Trojan:MacOS/HackBrowserData.A

The Trojan:MacOS/HackBrowserData.A infection chain activates when a developer builds a tampered Xcode project, initiating a sequenced process. The initial stage performs reconnaissance and deploys an obfuscated shell script, often using curl to fetch the next payload from a server at a domain like cdntor[.]ru or applecdn[.]ru. Subsequent stages are responsible for macOS profiling, gathering details on the macOS version, installed applications, and security software status. Following this, encrypted configuration files are retrieved and decrypted using AES with a hardcoded key, typically followed by Base64 decoding, to reveal the next set of instructions. A core module, sometimes identified in code as "iewmilh_cdyd," downloads the customized HackBrowserData binary. This Mach-O file is written to a temporary location such as /tmp/ancr.  

Trojan:MacOS/HackBrowserData.A then uses chmod to make it executable, applies an ad-hoc code signature, and runs it with specific command line arguments: -b firefox -f json --dir [path] --zip. This extracts the browser data, converts it to JSON, and packages it into encrypted zip archives for exfiltration, often in multiple parts. Clipboard manipulation is handled by a separate dedicated module. This module parses a configuration file containing regular expressions designed to identify cryptocurrency wallet addresses. It validates any matched text based on character length, typically between 50 and 300 characters, and checks against a blocklist of foreground applications to avoid interfering with certain programs. If the conditions are met, it silently replaces the copied wallet address with one controlled by the attacker.  

Persistence is a key focus, achieved by installing fraudulent LaunchDaemon property list files. These plists, with names like com.google.keystore.plist, are designed to mimic legitimate software and are placed in ~/Library/LaunchDaemons/. They are configured to launch a shell script payload stored in a hidden directory like ~/.root every time the mac starts. As a secondary method, it can also append malicious commands to shell initialization files such as ~/.zshrc to reactivate the infection whenever a new terminal window is opened. Compared to earlier XCSSET variants that exploited zero-day vulnerabilities in Safari for universal cross-site scripting and targeted a wider array of browsers like Chrome and Opera, this variant demonstrates a more focused toolset. However, it retains the sophisticated, multi-layered obfuscation and modular design that defines the family, continuing to pose a significant risk to developer ecosystems.