Researchers from the cybersecurity firm SentinelOne (opens in new tab) have discovered a trojanized code library that is being used in the wild to try and install surveillance malware (opens in new tab) on to the Macs (opens in new tab) of developers creating apps for iOS.
As reported by Ars Technica (opens in new tab), the campaign exploits Apple's Xcode (opens in new tab) developer tool for iOS and macOS and the attacker responsible created a malicious project using the tool in order to spread malware. However, the project itself was a copy of a legitimate open source project called TabBarInteraction that helps developers animate tab bars in iOS.
- We've built a list of the best antivirus (opens in new tab) software available
- Keep your devices virus free with the best malware removal (opens in new tab) software
- Also check out our roundup of the best Mac antivirus (opens in new tab)
The fake version of TabBarInteraction also included an obfuscated script called a “Run Script” which is executed whenever a developer build is launched. This script contacts a server controlled by the attacker to download and install a custom version of the open source backdoor (opens in new tab) EggShell which is used to spy on users through their microphone, camera and keyboard.
The researchers at SentinelLabs have given the trojanized project the name XcodeSpy as it exploits Apple's Xcode to make it possible for an attacker to spy on other Mac users.
Two variants of the customized EggShell backdoor dropped by the trojanized project have been discovered so far and both were uploaded to VirusTotal (opens in new tab) for further investigation. The first sample was uploaded in August of last year while the second one was uploaded in October.
In a new blog post (opens in new tab) detailing the firm's discovery, threat researcher at SentinelOne, Phil Stokes explained that there could be other XcodeSpy projects out there, saying:
“We have thus far been unable to discover other samples of trojanized Xcode projects and cannot gauge the extent of this activity. However, the timeline from known samples and other indicators mentioned below suggest that other XcodeSpy projects may exist. By sharing details of this campaign, we hope to raise awareness of this attack vector and highlight the fact that developers are high-value targets for attackers.”
To avoid falling victim to XcodeSpy, developers should exercise caution when downloading and installing new open source (opens in new tab) projects.
- We've also featured the best endpoint protection software (opens in new tab)
Via Ars Technica (opens in new tab)