Explore the new XCSSET macOS malware variant's tactics in crypto theft and advanced obfuscation techniques.

There are very few resources on macOS Malware Analysis of native file types. I have often struggled to learn it in the beginning. Hence I decided to write a detailed article on PKG file analysis!

Cyberkriminelle geben auf: Die Malware Banshee Stealer für MacOS wurde nach Veröffentlichung des Quellcodes aufgegeben. Der Artikel <a href="https://tarnkappe.info/artikel/it-sicherheit/banshee-stealer-quellcode-geleakt-macos-malware-unschaedlich-gemacht-304847.html">Banshee Stealer Quellcode geleakt: macOS-Malware unschädlich gemacht</a> erschien zuerst auf <a href="https://tarnkappe.info">TARNKAPPE.info</a>

At a glance Factor Details Malware Family AMOS (Atomic macOS Stealer), Light Stealer, and XMRig miner Threat Actor Unconfirmed cybercrime operator (Tracked via Polygon wallet) Target or Victims macOS users, cryptocurrency holders, and developers Delivery Vector ClickFix fake CAPTCHA lure on Cloudflare Pages Key Capabilities EtherHiding blockchain C2 resolution, credential theft, crypto wallet draining, cryptomining Source NetbyteSEC Research Team TL;DR&hellip;

encoded staging location right in their HTML read more about Over 250 ClickFix Domains Use Browser Fingerprinting to Hide macOS Malware Lures

At a Glance Field Detail Malware family CrashStealer (native C++ macOS infostealer) Threat actor Unattributed; part of a larger multi-platform operation Targets macOS users, especially cryptocurrency holders Delivery vector Signed, notarized dropper disk image posing as an installer Key capabilities Browser, wallet, password-manager and keychain theft; AES-GCM encryption; LaunchAgent persistence Source Jamf Threat Labs (July 2026) TL;DR Jamf Threat Labs has detailed a new macOS&hellip;

A mundane password prompt can swiftly transform your macOS desktop into a perilous snare. Specifically, a novel malicious program named ClickLock completely paralyzes the operating system. It persistently halts all functionality until the owner surrenders their vital credentials. According to threat intelligence experts at Group-IB, this insidious software has compromised at least one hundred targets. Furthermore, these victims span across thirty-three distinct countries since May.

  North Korean state-sponsored hackers have rolled out a new macOS malware strain dubbed NimDoor, designed to infiltrate Web3 and cryptocurrency organizations. According to a fresh analysis by SentinelOne researchers, the attackers leveraged uncommon methods and an innovative signal-based persistence mechanism never observed before. The attack chain starts with threat actors reaching out to potential victims through Telegram, persuading them to execute a bogus Zoom SDK update distributed via Calendly invitations and email—an approach reminiscent of tactics recently attributed to BlueNoroff by the managed security provider Huntress. SentinelOne’s report notes that the adversaries used a mix of C++ and Nim-compiled binaries (collectively referred to as NimDoor) on macOS—"a more unusual choice." One of these binaries, named 'installer,' handles the initial setup by preparing directories and configuration paths. It then deploys two additional components—'GoogIe LLC' and 'CoreKitAgent'—onto compromised systems. GoogIe LLC focuses on harvesting environment details and generating a hex-encoded configuration file, which is saved in a temporary directory. It also sets up a macOS LaunchAgent (com.google.update.plist) to ensure the malware runs automatically at login and retains authentication keys for future use. The most advanced piece of the toolkit is CoreKitAgent, the primary payload of NimDoor. This event-driven binary leverages macOS’s kqueue mechanism for asynchronous execution and implements a 10-state machine with a hardcoded transition table, enabling dynamic control depending on runtime conditions. A particularly distinctive characteristic is CoreKitAgent’s signal-based persistence, which relies on custom handlers for SIGINT and SIGTERM—signals typically used to terminate processes. "When triggered, CoreKitAgent catches these signals and writes the LaunchAgent for persistence, a copy of GoogIe LLC as the loader, and a copy of itself as the trojan, setting executable permissions on the latter two via the addExecutionPermissions_user95startup95mainZutils_u32 function," SentinelLABS explains. "This behavior ensures that any user-initiated termination of the malware results in the deployment of the core components, making the code resilient to basic defensive actions." Once active, CoreKitAgent decodes and executes a hex-encoded AppleScript that connects to command-and-control servers every 30 seconds, exfiltrates system information, and executes remote commands via osascript, effectively acting as a stealth backdoor. Alongside the main NimDoor infection, a parallel chain initiated by 'zoom_sdk_support.scpt' deploys 'trojan1_arm64', which establishes WebSocket Secure (WSS)-based communications with attacker infrastructure. It downloads two additional scripts—upl and tlgrm—to facilitate data theft. Notably, researchers discovered that the loader script contains over 10,000 blank lines to hinder detection. Upl focuses on extracting browser data, Keychain credentials, and shell history files (.bash_history and .zsh_history), transmitting the stolen information to dataupload[.]store via curl. Meanwhile, tlgrm targets Telegram data, including .tempkeyEncrypted files, likely to decrypt private messages exchanged on the platform. Overall, SentinelLABS describes NimDoor and its associated payloads as among the most complex macOS malware attributed to North Korean threat actors so far. The framework’s modular architecture and the use of novel persistence techniques underscore how DPRK operators are continuously refining their cross-platform attack capabilities to breach cryptocurrency ecosystems and steal sensitive information. SentinelLABS’ comprehensive report provides detailed indicators of compromise, including malicious domains, file paths, scripts, and binaries linked to these intrusions.  

A new info-stealing campaign called Infinity Stealer targets macOS by delivering a Python payload compiled into a native executable with the Nuitka compiler and lures users via a ClickFix fake Cloudflare CAPTCHA. The payload performs anti-analysis checks, harvests browser credentials, macOS Keychain entries, cryptocurrency wallets and plaintext developer secrets, and exfiltrates data to a C2 via HTTP while notifying operators via Telegram; users should never paste unknown commands into Terminal. #InfinityStealer #Nuitka

Infiniti Stealer is a previously undocumented macOS infostealer delivered via a ClickFix social‑engineering scheme that tricks users into pasting a Terminal command to fetch a Bash dropper and ultimately runs a Nuitka‑compiled Python stealer. The malware decodes and executes staged payloads, removes quarantine flags, harvests browser credentials, Keychain entries, wallets, and...

XCSSET, a sophisticated macOS malware, has been upgraded to bypass antivirus. Learn how it steals data and protect yourself by updating software and being cautious of downloads. Microsoft Defender now detects it. Tools used for generation Text Gemini Narator Azure TTS Clips Pexel Rendering Remotion

A newly discovered macOS malware dubbed "Gaslight" is designed to confuse AI-assisted malware analysis tools by hiding prompt injection strings and fake debugging data within the executable.