The threat escalates since we have identified affected developers who shared their projects on GitHub, leading to a supply-chain-like attack for users who rely on these repositories as dependencies in their own projects. This poses a risk for Xcode developers in particular.
This scenario is quite unusual in this case, malicious code is injected into local Xcode projects so that when the project is built, the malicious code is run. Most notable in our investigation is the discovery of two zero-day exploits: one is used to steal cookies via a flaw in the behavior of Data Vaults, another is used to abuse the development version of Safari. Upon further investigation, we discovered that a developer’s Xcode project at large contained the source malware, which leads to a rabbit hole of malicious payloads. We have discovered an unusual infection related to Xcode developer projects.
