Macos malware used runonly applescripts to

#Macos malware used runonly applescripts to update#
#Macos malware used runonly applescripts to software#
#Macos malware used runonly applescripts to mac#

So far, six active C&C domains share the same IP address of 9413027189: Although it contains the keywords 'trend micro', it has nothing to do with Trend Micro. Interestingly, even though the /usr/bin/open command works fine for fake apps on M1 systems, it still uses its own open tool.Дays after we released our second technical brief on this malware, a new domain named 'trendmicronanocomвЂќ was added to its C&C server. Launch the /Contents/macOS/applet' || echo 0 2>&1 &>/dev/null.The main routine of the open tool is as follows: The malware then downloads its own open tool from its C&C server that comes pre-signed with an ad-hoc signature, whereas if it were on macOS versions 10.15 and lower, it would still use the system's built-in open command to run the apps. As weвЂ™ve observed in safari_remote.applescript, it downloads a corresponding Safari package according to the userвЂ™s current browser and OS versions (Figure 2).Д«ut as we have seen from its source code, the malware can cleverly circumvent macOS 11's new security policies: Its fake apps and files are codesigned with an ad-hoc signature using the codesign -force -deep -s - command.

To adapt to the newly-released Big Sur, new packages for вЂњSafari 14вЂќ were added (Figure 1).

#Macos malware used runonly applescripts to update#

It hosts Safari update packages in the C&C server, then downloads and installs packages for the userвЂ™s OS version. Besides adding support for the M1 chip, XCSSET malware has taken other actions to fit macOS 11 Big Sur as well.ДЄs mentioned in our first technical brief, this malware leverages the development version of Safari to load malicious Safari frameworks and related JavaScript backdoors from its C&C server. We checked the binary files downloaded from the command and control (C&C) server and discovered that nearly all of them were files containing both x86_ењ†4 and ARM64 architectures, save for three that only had an x86_64 architecture.

#Macos malware used runonly applescripts to software#

Software with x86_64 architecture can still run on macOS 11 with the help of Rosetta 2, an emulator built into Big Sur, but most software developers may prefer to update their software so it can support ARM64.ДЄccording to Kaspersky, new samples from the malware were discovered that can run on Macs with the new M1 chip.

#Macos malware used runonly applescripts to mac#

Last November, Apple released its operating system Big Sur alongside new Mac products equipped with ARM-based M1 processors. Our follow-up update covered the third exploit we found that takes advantage of other popular browsers in macOS to implant a Universal Cross-site Scripting (UXSS) injection. In our first blog post and technical brief on XCSSET, we discussed at length the dangers it posed to Xcode developers and how it exploited two macOS vulnerabilities to maximize what it can take from an infected machine. This latest update details our new research regarding XCSSET, including the ways in which it has adapted itself to work on both ARM64 and x86_ењ†4 Macs, as well as other notable payload changes. Initially reported as a malware family, in light of our recent findings it is now classified as an ongoing campaign. Last year, we first found XCSSET, which targeted Mac users by infecting Xcode projects.