Recommended Free Tools
XcodeSpy was macOS malware hidden in a tampered Xcode project. Building the project could run an obfuscated script that downloaded an EggShell backdoor, turning a routine developer workflow into an infection route. The incident was reported in 2021 and concerned campaign activity estimated to run from July through October 2020.
How XcodeSpy infected a Mac
The attackers distributed a doctored copy of TabBarInteraction, a legitimate open-source Xcode project. They inserted an obfuscated Run Script in the project’s Build Phases. When a developer built the target, the script contacted attacker infrastructure and installed a customized EggShell backdoor. Because the script ran as part of the normal build process, opening and building an untrusted shared project—not installing a conventional Mac app—was the infection path. SentinelOne’s analysis and SecurityWeek’s report describe the incident.
What the EggShell backdoor could do
SentinelOne documented an EggShell variant customized for this campaign. It could record microphone, camera, and keyboard input, and upload or download files. The analysis also mapped keylogging, process discovery, and transfer of additional tools. A user LaunchAgent gave the malware a way to persist across reboots; the investigators documented customized paths, hidden files, and temporary artifacts. SentinelOne’s technical analysis details these behaviors.
What is known about the campaign
SentinelOne reported one known in-the-wild case involving a U.S. organization and samples uploaded to VirusTotal from Japan. Its analysis estimated that the campaign operated at least from July through October 2020 and suggested developers in Asia may have been targets. The total number of victims was unknown.
#1 Best Overall
![Malwarebytes Standard, Premium Security| Amazon Exclusive | 18 Months, 2 Devices | Windows, Mac OS, Android, Apple iOS, Chrome [Online Code]](https://m.media-amazon.com/images/I/41LbYnawq9L._SL160_.jpg)
- AWARD WINNING Antivirus, anti-malware, anti-spyware & more
- 24/7 REAL TIME PROTECTION against emerging malware threats, including ransomware and viruses- without slowing you down.
- PROTECTS YOUR DEVICES ON MULTIPLE PLATFORMS: Get cyber protection for your computers, smartphones, or tablets- Compatible with Windows, Mac, Android, iOS
- DOWNLOAD AND INSTALL INSTANTLY
- UNMATCHED THREAT DETECTION: We found malware on 40 percent of devices that already had a third-party antivirus installed.
A victim reported repeated targeting by North Korean APT actors, but investigators did not establish definitive nation-state attribution. The report supports describing XcodeSpy as a developer-targeting campaign; it does not support stating that North Korea was conclusively responsible. SecurityWeek also noted that the victim count was unknown.
How to check an Xcode project for suspicious scripts
Inspect Build Phases in Xcode
- Open the project in Xcode, but do not build a project you do not trust.
- Select the project in the navigator, choose the relevant target, then open Build Phases.
- Review each Run Script phase. Check whether its purpose and commands make sense for the project, and look for obfuscation, unexpected network activity, or commands that download or execute files.
- Verify questionable code against the project’s trusted upstream source or ask its maintainer before running it.
Search project files from Terminal
This published command searches for lines in Xcode project files that contain both shellScript and eval:
Rank #2
- STAY PROTECTED EVERYWHERE you go, at home, in a café, at the airport—everywhere—on ALL YOUR DEVICES, with cloud-based protection against viruses & other online threats
- Webroot PASSWORD MANAGER by Last Pass creates, encrypts, and saves all your passwords, so you only have to remember one.
- As the #1 TRUSTED PROVIDER OF THREAT INTELLIGENCE, you know you’re in good hands. Stay safe from viruses, ransomware, phishing, and more.
- Webroot SOFTWARE UPDATES ITSELF AUTOMATICALLY, so you always have the most current protection without lifting a finger—and updates happen in the background so they won’t slow you down.
- PREMIUM FEATURES: Encrypts & protects passwords and account information for all your devices so you can stay protected wherever you are.
find . -name "project.pbxproj" -print0 | xargs -0 awk '/shellScript/ && /eval/{print " 33[37m" $0 " 33[31m" FILENAME}'Run it from the directory you want to inspect. A match is a triage lead, not proof of malware: review the surrounding project configuration and script in context. A clean result is not a guarantee of safety, because a malicious script can use different techniques.
How to reduce the risk
- Get projects from maintainers or repositories you trust, and be cautious with unsolicited project archives or copies.
- Review Build Phases, especially Run Script entries, before building unfamiliar code.
- Use behavioral endpoint monitoring as well as static indicators. SentinelOne warned that paths, command-and-control domains, and encrypted strings can be customized, limiting the usefulness of indicators drawn from known samples.
Why a developer workstation matters
SentinelOne framed developer targeting as a possible first step toward a software supply-chain attack. A compromised development environment could create opportunities to steal credentials, source code, or code-signing assets, or gain access to software-build workflows. Those are potential consequences, not outcomes established in the known XcodeSpy case. SentinelOne said XcodeSpy appeared to target developers themselves rather than their products or clients, while warning that compromising a developer’s environment could create a route to users of that developer’s software. Read SentinelOne’s assessment.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteQuick Recap
Best Value
![Norton 360 Deluxe 2027 Antivirus, 3 Devices, Auto-Renews [Download]](https://m.media-amazon.com/images/I/41qw3FS3qLL._SL160_.jpg)
- ONGOING PROTECTION Download instantly & install protection for 3 PCs, Macs, iOS or Android devices in minutes!
- TOP-PERFORMING VPN Faster speeds, more server locations, and greater connection control to protect your privacy across all your devices, including Smart TVs.
- ADVANCED SCAM PROTECTION Help spot hidden scams online. With the built-in Genie AI assistant, you’ll never wonder if a message or email is suspicious again.
- REAL-TIME PROTECTION Advanced security protects against existing and emerging malware threats, including ransomware and viruses, and it won’t slow down your device performance.
- DARK WEB MONITORING Identity thieves can buy or sell your information on websites and forums. We search the dark web and notify you should your information be found.
Rank #4
- THREAT DETECTION – Stay one step ahead. Suspicious links, risky sites, viruses, and scams, caught automatically before they reach you.
- PERSONAL INFO PROTECTION – Keep your personal info safer. Identity monitoring watches for your exposed info and tells you what to do about it.
- SECURE CONNECTIONS – Just a few clicks, and your info stays protected on public Wi-Fi every time you connect.
- PERSONAL DATA SCANS – Take your info off the market. We’ll find your personal information on sites selling it, then guide you on how to remove it.
- SOCIAL PRIVACY MANAGER – Decide what you share. McAfee finds the privacy settings buried in your social accounts and fixes them.
Rank #3
- THREAT DETECTION – Stay one step ahead. Suspicious links, risky sites, viruses, and scams, caught automatically before they reach you.
- PERSONAL INFO PROTECTION – Keep your personal info safer. Identity monitoring watches for your exposed info and tells you what to do about it.
- SECURE CONNECTIONS – Just a few easy clicks, and we'll automatically protect your info on public Wi‑Fi, every time you connect.
- GUIDED ACTION – Know what matters and what to do next. Clear alerts and simple guidance make it easy to take action.
- MORE THAN ANTIVIRUS – Scam protection, identity monitoring, VPN, web protection, and antivirus work together to protect you, all in one place.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
