Security Researchers Discover XcodeSpy Malware That Targets Developers
Developers need to look out for "XcodeSpy," a malicious Xcode project that installs a custom variant of the "EggShell" backdoor on a macOS computer, according to new research shared today by SentinelOne (via Ars Technica).
Xcode is software designed for developers who want to write apps for the iOS and macOS platforms, and the malicious project that's circulating mirrors TabBarInteraction, a legitimate open source project.
Developers who download the XcodeSpy project think they're getting TabBarInteraction, but the malware includes a hidden "run Script" executable that downloads and installs the EggShell open source back door that's able to spy on users through the microphone, camera, and keyboard as well as upload and download files.
Two variants of the custom EggShell attack were found to be uploaded in Japan, first in August and then in October, so this is an attack that's been out in the wild for some time.
We have thus far been unable to discover other samples of trojanized Xcode projects and cannot gauge the extent of this activity. However, the timeline from known samples and other indicators mentioned below suggest that other XcodeSpy projects may exist. By sharing details of this campaign, we hope to raise awareness of this attack vector and highlight the fact that developers are high-value targets for attackers.
SentinelOne says that all Apple Developers that use Xcode should exercise caution when using shared Xcode projects.
Popular Stories
Apple is planning a series of "major design" and "format changes" for iPhones over the next few years, according to The Wall Street Journal's Aaron Tilley and Yang Jie.
The paywalled report published today corroborated the widely-rumored "iPhone 17 Air" with an "ultrathin" design that is thinner than current iPhone models. The report did not mention a specific measurement, but previous...
Apple today seeded the first betas of upcoming iOS 18.3 and iPadOS 18.3 updates to developers for testing purposes, with the software coming a week after Apple released iOS 18.2 and iPadOS 18.2.
iOS 18.3 and iPadOS 18.3 can be downloaded from the Settings app on a compatible device by going to General > Software update.
There's no word yet on what's included in iOS 18.3 and iPadOS 18.3, ...
The current Apple TV 4K was released more than two years ago, so the streaming device is becoming due for a hardware upgrade soon. Fortunately, it was recently rumored that a new Apple TV will launch at some point next year.
Below, we recap rumors about the next-generation Apple TV.
Bloomberg's Mark Gurman last week reported that Apple has been working on its own combined Wi-Fi and...
Apple is working on a redesigned Magic Mouse that will address some "longstanding complaints," according to Bloomberg's Mark Gurman.
In his Power On newsletter today, Gurman said Apple in recent months has been working on a "full overhaul" of the Magic Mouse with a design that "better fits the modern era." However, he does not expect the new Magic Mouse to be released in the "next 12 to 18...
Apple plans to release a second-generation AirTag next year with "considerably" longer range for item tracking, according to Bloomberg's Mark Gurman.
In his Power On newsletter today, Gurman said the new AirTag will use Apple's second-generation Ultra Wideband chip, or equivalent technology. The chip debuted last year in the iPhone 15 and the Apple Watch Ultra 2, and Apple said it offers up...
Apple on Monday seeded the first tvOS 18.3 beta to developers for testing. The update will likely be released in January. So far, there are only minor changes for the Apple TV, with one new feature and a few code changes discovered.
Below, we outline what is new in tvOS 18.3 so far.
Robot Vacuum Support in Home App
First, tvOS 18.3 will add robot vacuum support to the Home app on the...
