By Mac Threat Response and Mobile Research Team
We have discovered an unusual infection related to Xcode developer projects. Upon further investigation, we discovered that a developer’s Xcode project at large contained the source malware, which leads to a rabbit hole of malicious payloads. Most notable in our investigation is the discovery of two zero-day exploits: one is used to steal cookies via a flaw in the behavior of Data Vaults, another is used to abuse the development version of Safari.
Go to the Trend Micro Security (for Mac) section and click Download. The size of the file to be downloaded displays beside the Download button. Plug-in Manager downloads the package to PCCSRVDownload. Is typically C:Program FilesTrend MicroOfficeScan. 2020 version Cover Windows 8.1&10 Mac OS, Android, IOS. For PC: 'Trend Micro Maximum Security' For MAC 'Trend Micro Antivirus for Mac ' For mobile 'Trend Micro Mobile Security' Full 3 years (1095 days) 3 Devices subscribe, Guarantee never used, bind your own email. Suitable for renewals or new activations. Worry-free return, refund policy.
This scenario is quite unusual; in this case, malicious code is injected into local Xcode projects so that when the project is built, the malicious code is run. This poses a risk for Xcode developers in particular. The threat escalates since we have identified affected developers who shared their projects on GitHub, leading to a supply-chain-like attack for users who rely on these repositories as dependencies in their own projects. We have also identified this threat in sources such as VirusTotal, which indicates this threat is at large.
This blog will summarize the findings of this threat, while its accompanying technical brief contains the full details of this attack. We detected the entry threat as TrojanSpy.MacOS.XCSSET.A and its command and control (C&C) related files as Backdoor.MacOS.XCSSET.A.
This threat primarily spreads via Xcode projects and maliciously modified applications created from the malware. It is not yet clear how the threat initially enters these systems. Presumably, these systems would be primarily used by developers. These Xcode projects have been modified such that upon building, these projects would run a malicious code. This eventually leads to the main XCSSET malware being dropped and run on the affected system. Infected users are also vulnerable to having their credentials, accounts, and other vital data stolen.
Once present on an affected system, XCSSET is capable of the following behavior:
The method of distribution used can only be described as clever. Affected developers will unwittingly distribute the malicious trojan to their users in the form of the compromised Xcode projects, and methods to verify the distributed file (such as checking hashes) would not help as the developers would be unaware that they are distributing malicious files.
Further details of this attack may be found in its related technical brief.
Trend Micro Solutions
To protect systems from this type of threat, users should only download apps from official and legitimate marketplaces. Users can also consider multilayered security solutions such as Trend Micro Home Security for Mac, which provides comprehensive security and multidevice protection against cyberthreats.
Enterprises can take advantage of Trend Micro’s Smart Protection Suites with XGen™ security, which infuses high-fidelity machine learning into a blend of threat protection techniques to eliminate security gaps across any user activity or endpoint.
|hxxps://adobestats.com/||Block and Categorized as C&C Server|
|hxxps://flixprice.com/||Block and Categorized as C&C Server|
|22.214.171.124||Block and Categorized as C&C Server|
Bulletin Date: September 30, 2020
Assigned CVE: CVE-2020-25776
CVSSv3 Score: 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Severity Rating: High
The Trend Micro Antivirus for Mac 2020 consumer family of products has released an update via ActiveUpdate to address a symbolic link privilege escalation vulnerability.
|Antivirus for Mac||2020 (v10.x)||macOS||English|
|Antivirus for Mac||2019 (v9.x)||macOS||English|
|Antivirus for Mac||2020 (v10.x) via ActiveUpdate||macOS||English|
Trend Micro has addressed this vulnerability on the 2020 family of products (version 10.x) via a patch that is available now through the product’s automatic ActiveUpdate feature for all versions of Trend Micro Antivirus for Mac listed above. Customers who have at least version 10.0 will already have the necessary patch applied. Customers who have version 9.0 and below are recommended to install the latest version to address the issue.
The latest versions of Trend Micro Antivirus for Mac can be found here.
Trend Micro Antivirus for Mac 2020 (Consumer) is vulnerable to a symbolic link privilege escalation attack where an attacker could exploit a critical file on the system to escalate their privileges.
Trend Micro has received no reports nor is aware of any actual attacks against the affected product related to this vulnerability at this time.
Trend Micro would like to thank the following individual for responsibly disclosing the issue and working with Trend Micro to help protect our customers:
Customers who have questions are encouraged to contact Trend Micro Technical Support for further assistance.