XCSSET
Software · ATTACK:enterprise:S0658
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:S0658",
"title": "XCSSET",
"type": "Software",
"source_url": "https://attack.mitre.org/software/S0658",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "malware--e14085cb-0e8d-4be6-92ba-e3b93ee5978f",
"external_id": "S0658",
"domain": "enterprise",
"created": "2021-10-05T21:58:51.161Z",
"modified": "2025-04-04T17:39:46.453Z",
"version": "1.3",
"aliases": [
],
"tactics": [
],
"source_references": [
{
"source_name": "OSX.DubRobber"
},
{
"source_name": "XCSSET"
},
{
"source_name": "trendmicro xcsset xcode project 2020",
"url": "https://documents.trendmicro.com/assets/pdf/XCSSET_Technical_Brief.pdf"
},
{
"source_name": "Microsoft March 2025 XCSSET",
"url": "https://www.microsoft.com/en-us/security/blog/2025/03/11/new-xcsset-malware-adds-new-obfuscation-persistence-techniques-to-infect-xcode-projects/"
},
{
"source_name": "April 2021 TrendMicro XCSSET",
"url": "https://www.trendmicro.com/en_us/research/21/d/xcsset-quickly-adapts-to-macos-11-and-m1-based-macs.html"
},
{
"source_name": "malwarebyteslabs xcsset dubrobber",
"url": "https://blog.malwarebytes.com/detections/osx-dubrobber/"
}
]
}Explicit source assertions (33)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:S0658 → uses → ATTACK:enterprise:T1564.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--05ee3203-83ad-4dd3-8590-b7f3ffcf772a
trendmicro xcsset xcode project 2020ATTACK:enterprise:S0658 → uses → ATTACK:enterprise:T1518
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0ecc1e3a-340a-42b6-9739-c6a243ffaa8f
trendmicro xcsset xcode project 2020ATTACK:enterprise:S0658 → uses → ATTACK:enterprise:T1614.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1878edcb-e458-494c-81a5-34d8a0390957
trendmicro xcsset xcode project 2020ATTACK:enterprise:S0658 → uses → ATTACK:enterprise:T1105
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--30e190f8-2f7d-4795-9bed-90576fafdd0b
trendmicro xcsset xcode project 2020ATTACK:enterprise:S0658 → uses → ATTACK:enterprise:T1041
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--399b8688-1fe9-4fa6-a984-7c01f9319a38
trendmicro xcsset xcode project 2020 · Microsoft March 2025 XCSSETATTACK:enterprise:S0658 → uses → ATTACK:enterprise:T1553.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3a72e519-b85c-4dec-9ffd-74eec8af03ca
Application Bundle Manipulation Brandon DaltonATTACK:enterprise:S0658 → uses → ATTACK:enterprise:T1036
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--51650560-9aff-460b-9766-14c83bdb2198
trendmicro xcsset xcode project 2020 · Microsoft March 2025 XCSSETATTACK:enterprise:S0658 → uses → ATTACK:enterprise:T1195.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--55a9fab0-30f8-45f5-b48d-7edbd961404d
trendmicro xcsset xcode project 2020ATTACK:enterprise:S0658 → uses → ATTACK:enterprise:T1098.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5b6ff16b-9958-432c-bad9-5260d549117a
trendmicro xcsset xcode project 2020ATTACK:enterprise:S0658 → uses → ATTACK:enterprise:T1005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--71c512cd-2372-400e-92ea-2c84760b81f5
trendmicro xcsset xcode project 2020ATTACK:enterprise:S0658 → uses → ATTACK:enterprise:T1573.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--78adc73a-0f8c-498e-9451-7f9081f81595
trendmicro xcsset xcode project 2020ATTACK:enterprise:S0658 → uses → ATTACK:enterprise:T1574.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7af3fbea-cdb1-42e3-a5f0-8ad2e418baff
trendmicro xcsset xcode project 2020ATTACK:enterprise:S0658 → uses → ATTACK:enterprise:T1560
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7bbd6131-24cd-437e-8057-02f84b357cbe
trendmicro xcsset xcode project 2020ATTACK:enterprise:S0658 → uses → ATTACK:enterprise:T1548.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--83116ad2-7302-4c5b-9a43-5a32c5bd2c32
Microsoft March 2025 XCSSETATTACK:enterprise:S0658 → uses → ATTACK:enterprise:T1222.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9021af47-45ef-4021-a697-d76ccb790f07
20 macOS Common Tools and TechniquesATTACK:enterprise:S0658 → uses → ATTACK:enterprise:T1539
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--acfadf9a-afa5-413e-8855-a96947c5ab26
trendmicro xcsset xcode project 2020ATTACK:enterprise:S0658 → uses → ATTACK:enterprise:T1056.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b019c5ea-be5e-453a-9ed6-e86384c92259
trendmicro xcsset xcode project 2020ATTACK:enterprise:S0658 → uses → ATTACK:enterprise:T1068
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b26307f7-2d5a-4139-8333-e2c7a583f939
trendmicro xcsset xcode project 2020ATTACK:enterprise:S0658 → uses → ATTACK:enterprise:T1569.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b502aff3-128e-4715-a8bc-7b7b8fa0be74
trendmicro xcsset xcode project 2020ATTACK:enterprise:S0658 → uses → ATTACK:enterprise:T1518.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b655c9e9-a6c1-42e9-9df7-60ab64b7f65a
trendmicro xcsset xcode project 2020ATTACK:enterprise:S0658 → uses → ATTACK:enterprise:T1486
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--cb043548-a193-4ade-b69d-d83e3378d255
trendmicro xcsset xcode project 2020ATTACK:enterprise:S0658 → uses → ATTACK:enterprise:T1082
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--cb37da3b-6ffd-4882-9680-4e467f25d7f4
trendmicro xcsset xcode project 2020ATTACK:enterprise:S0658 → uses → ATTACK:enterprise:T1543.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ce0e6abe-ebdb-45f4-a403-261587e0fa0f
trendmicro xcsset xcode project 2020ATTACK:enterprise:S0658 → uses → ATTACK:enterprise:T1647
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d4992852-13b0-4bfb-aee3-09d658a52785
trendmicro xcsset xcode project 2020 · Microsoft March 2025 XCSSETATTACK:enterprise:S0658 → uses → ATTACK:enterprise:T1027.013
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--dac0cbc1-227d-41d7-aabf-6c54a009d3c9
Microsoft March 2025 XCSSETATTACK:enterprise:S0658 → uses → ATTACK:enterprise:T1083
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--de15c868-b002-415c-937b-b365e4c60597
Application Bundle Manipulation Brandon Dalton · Microsoft March 2025 XCSSETATTACK:enterprise:S0658 → uses → ATTACK:enterprise:T1059.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--de1f13d3-a6a0-4170-947d-81b59d1262ef
trendmicro xcsset xcode project 2020ATTACK:enterprise:S0658 → uses → ATTACK:enterprise:T1497.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e1ee2aae-72b0-4258-abab-2705d6b9268a
trendmicro xcsset xcode project 2020ATTACK:enterprise:S0658 → uses → ATTACK:enterprise:T1554
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e2e10525-62f5-42ba-a923-ed29cfb4040e
trendmicro xcsset xcode project 2020ATTACK:enterprise:S0658 → uses → ATTACK:enterprise:T1087
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e481bd6a-3143-4fd6-b1d9-97d1060f423d
trendmicro xcsset xcode project 2020ATTACK:enterprise:S0658 → uses → ATTACK:enterprise:T1546
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e939c173-65a4-453e-b45e-d3cbef9b10dd
Microsoft March 2025 XCSSET · April 2021 TrendMicro XCSSETATTACK:enterprise:S0658 → uses → ATTACK:enterprise:T1113
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f53a225d-093b-4d90-9916-1e5981dbf95a
trendmicro xcsset xcode project 2020ATTACK:enterprise:S0658 → uses → ATTACK:enterprise:T1546.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f5ad06d8-9cfa-43b9-be1b-95b48a5ff0c9
Microsoft March 2025 XCSSET