New XLoader macOS Malware Variant Disguised as OfficeNote

Cybersecurity researchers at SentinelOne have identified a new variant of the notorious XLoader malware targeting macOS users. Disguised as a fake productivity software named “OfficeNote”, the malware is being distributed widely in a significant campaign.

XLoader, a persistent malware-as-a-service infostealer and keylogger, has been active in some form or another since 2015. After surfacing on macOS in 2021 as a Java program, it encountered limitations due to the absence of the Java Runtime Environment by default. However, this latest incarnation is coded in C and Objective C languages — making this dependency no longer necessary.

This new variant of XLoader is bundled within a standard Apple disk image named 'OfficeNote.dmg'. SentinelOne's Dinesh Devadoss and Phil Stokes revealed that the application carries a developer signature attributed to MAIT JAKHU (54YDV8NU9C), although Apple has since revoked this signature.

Upon execution, the 'OfficeNote' application displays a misleading error message. While victims perceive it as non-functional, the malware deposits its payload and installs a persistence agent in the background. XLoader also employs various tactics to thwart analysis, such as sleep commands and binary stripping with high entropy.

XLoader's primary objective remains the theft of sensitive data. Clipboard contents and browser data are its prime targets, with a particular focus on Google Chrome and Mozilla Firefox browsers – Safari remains off its radar.

What's also concerning is the malware's reach. Numerous submissions of this variant have surfaced on VirusTotal throughout July, indicating widespread distribution.

Underground forums advertise the macOS version of XLoader for rent at $199 per month or $299 for a three-month period. This pricing strategy is notably steeper than the malware’s Windows counterparts.

As cyber threats continue to evolve, staying vigilant and adopting comprehensive security measures is imperative. The emergence of XLoader's 'OfficeNote' variant underscores the importance of proactive cybersecurity practices to safeguard sensitive information and digital assets.