Detects new Xcode malware targeting iOS developers

The ultimate goal is to install a backdoor on a developer's macOS computer for later malicious activity.

If you do not know, Xcode is a free application development environment created by Apple and built into the Mac operating system. Xcode allows developers to create apps that run on macOS, iOS, tvOS, and watchOS.

Like many other application development environments, developers on Xcode often create specialized projects to perform specific functions. These projects can then be shared online so other developers can contribute or leverage to create their own products.

Taking advantage of this fact, attackers are increasingly actively creating malicious, fake projects, in the hope that they can be incorporated into other developers' applications. When those apps are compiled, the malicious component infects the developer's computer in a typical supply chain attack.

Researchers from cybersecurity company SentinelOne have discovered a malicious version of the legitimate iOS project TabBarInteraction Xcode, currently being spread during a supply chain attack.

As part of the attack, the attacker cloned the legitimate TabBarInteraction project and added a cryptic malicious 'Run Script' script to the project, as shown below. This malicious version of TabBarInteraction has been dubbed ' XcodeSpy ' by SentinelOne .

Detects new Xcode malware targeting iOS developers Picture 1

Once the project is built, Xcode will automatically execute the Run Script to open a remote shell back to the attacker's server. This server is called cralev.me .

' The script will create a hidden file named .tag in the / tmp directory, containing a single command: mdbcmd. It will then be routed through a shell, sent back to the attackers' C2 server , "explained SentinelOne security expert Phil Stokes in a new report.

Detects new Xcode malware targeting iOS developers Picture 2

By the time SentinelOne discovered this malicious project, the C2 server was no longer available, so it is not clear what actions were taken through this back-interacting shell.

However, researchers have discovered two malware samples uploaded to VirusTotal containing the same string " /private/tmp/.tag ". That may indicate that they are part of this attack.

' By the time the malicious Xcode project was discovered, the C2 cralev [.] Me server was offline. Therefore it is not possible to determine the result of the mdbcmd command directly . Fortunately, however, there are two EggShell backdoor templates on VirusTotal that contain the Telltale XcodeSpy /private/tmp/.tag ' string .

The Backdoor EggShell allows threat agents to upload and download files, execute commands, and snoop on the victim's microphone, camera, and keyboard.

Currently, it is not clear how this malicious Xcode project was distributed.

Marvin Fry

Update 23 March 2021

You should read it

May be interested

The number of malware on Macs is nearly double that of Windows
macs are safer and less likely to be infected with malware than windows, which many users still trust. however, this is no longer true when a recent report showed that in 2019, the number of threats targeting the mac surpassed the pc by 2: 1.
What is SquirrelWaffle malware? How to avoid?
called dropper malware, the developers of squirrelwaffle have gone to great lengths to keep it hard to detect and analyze.
Discovering many applications containing malware on Google Play Store, Android users should worry gradually
the new google play store has discovered a lot of malware-infected applications never seen before. security companies have been reporting malware campaigns hidden in the android app on the google play store.
Detecting dangerous backdoors targeting both Windows, macOS and Linux
international cybersecurity researchers have just issued an urgent notice about a new type of cross-platform malware called 'sysjoker' that has been appearing all over the world.
Instructions on how to remove multi-platform malware on Facebook Messenger
malware is nothing new, but in the summer of 2017 a new variant appears targeting users via facebook messenger and notifying them of installing adware or trojan software. how can you detect these malware and how to remove them?
How to uninstall Chromium Malware with 4 easy steps
chromium malware is a popular option for fake developers. chromium malware may look almost like a real package.
Warning: The Joker malware has infected over 500,000 Huawei Android devices
the joker, one of the most persistent and dangerous strains of malware targeting android devices, has just been discovered.
New Cuckoo Malware Is Targeting Mac Users: Here's How to Spot It!
although mac users are less likely to encounter viruses than windows users, hackers still find ways to introduce viruses to wreak havoc on macos. one of them is the cuckoo virus.
How to Run Windows Defender Offline
windows defender offline is a specialized tool that detects and removes persistent malware such as rootkits. windows defender offline is used in the event that windows defender or microsoft security essentials detects an anomaly that...
How to protect PowerShell from fileless attacks from the Remcos RAT malware
excel users need to be on guard as a newly discovered phishing campaign is targeting microsoft's spreadsheet application.

Detects new Xcode malware targeting iOS developers

You should read it

May be interested

Tech info