Researchers from the cybersecurity firm SentinelOne have discovered a trojanized code library that is being used in the wild to try and install surveillance malware on to the Macs of developers creating apps for iOS.
As reported by Ars Technica, the campaign exploits Apple's Xcode developer tool for iOS and macOS and the attacker responsible created a malicious project using the tool in order to spread malware. However, the project itself was a copy of a legitimate open source project called TabBarInteraction that helps developers animate tab bars in iOS.
- We've built a list of the best antivirus software available
- Keep your devices virus free with the best malware removal software
- Also check out our roundup of the best Mac antivirus
The fake version of TabBarInteraction also included an obfuscated script called a “Run Script” which is executed whenever a developer build is launched. This script contacts a server controlled by the attacker to download and install a custom version of the open source backdoor EggShell which is used to spy on users through their microphone, camera and keyboard.
XcodeSpy
The researchers at SentinelLabs have given the trojanized project the name XcodeSpy as it exploits Apple's Xcode to make it possible for an attacker to spy on other Mac users.
Two variants of the customized EggShell backdoor dropped by the trojanized project have been discovered so far and both were uploaded to VirusTotal for further investigation. The first sample was uploaded in August of last year while the second one was uploaded in October.
In a new blog post detailing the firm's discovery, threat researcher at SentinelOne, Phil Stokes explained that there could be other XcodeSpy projects out there, saying:
“We have thus far been unable to discover other samples of trojanized Xcode projects and cannot gauge the extent of this activity. However, the timeline from known samples and other indicators mentioned below suggest that other XcodeSpy projects may exist. By sharing details of this campaign, we hope to raise awareness of this attack vector and highlight the fact that developers are high-value targets for attackers.”
To avoid falling victim to XcodeSpy, developers should exercise caution when downloading and installing new open source projects.
- We've also featured the best endpoint protection software
Via Ars Technica
