Microsoft warns users about a powerful new Mac malware: What you should know

Microsoft has discovered a new and more dangerous version of the XCSSET macOS malware circulating in the wild. Here are the details.

Microsoft has identified a new macOS malware that was found in Xcode projects in the wild, and notably, it is a variant of the existing XCSSET malware, but with new abilities.

MacBook Air M4 models are expected within weeks as per Bloomberg's Mark Gurman. (Unsplash)

By Shaurya Sharma

Shaurya Sharma is the Technology Editor at Hindustan Times Digital Streams, where he oversees technology coverage across digital and social platforms. With over eight years of experience across editorial, video production, and digital media, his work focuses on smartphones, AI, consumer gadgets, and shaping audience-first content strategies for modern tech consumers.

He began his career in 2018 as a fashion cinematographer before turning his lifelong passion for technology into a profession. From spending his childhood immersed in tech magazines, video games, and the latest gadgets to covering the global consumer tech industry today, technology has remained a constant throughout his journey.

Over the years, Shaurya has worked with some of India’s leading media organisations, including CNN-News18, Sportskeeda, and Guiding Tech, where he led video initiatives that combined strong editorial storytelling with engaging visual and social-first execution.

A graduate in Journalism and Mass Communication from Manipal University, Shaurya has reviewed hundreds of products across categories including smartphones, laptops, gaming consoles, cameras, and wearables. Beyond work, he is passionate about animal welfare, environmental causes, and automobiles, particularly turbo-petrol cars

Read moreRead less

The Microsoft Threat Intelligence team wrote on X that this is the first known variant since 2022. This malware features improved obfuscation techniques, updated persistence mechanisms, and new infection strategies, all of which suggest it is a more advanced and capable form of malware with greater potential to cause harm. These new capabilities add to its already sophisticated features, such as being able to target digital wallets, extracting data from the Notes app, and accessing system information files.

What you need to know about the latest XCSSET malware variant

Microsoft reported on X that this new variant has better obfuscation techniques, utilising a more randomised approach for generating payloads within Xcode projects. In fact, both its encoding technique and the number of encoding iterations are randomised.

Additionally, Microsoft noted that this variant incorporates Base64 encoding alongside the older XXD hex dump method for encoding. Simply put, this makes it significantly harder to determine the malware’s intent and functionality.

The Microsoft Threat Intelligence team also explained that the malware ensures every time the Launchpad is started, both it and a malicious payload are executed. Furthermore, new infection techniques have been introduced, including new methods for placing payloads within targeted Xcode projects.

What should users do to stay safe?

A general rule of thumb is to only download and install software from trusted sources and official app stores. Microsoft also confirmed that Microsoft Defender for Endpoint on Mac can detect XCSSET, including this new variant.