Aikido Finds XCSSET in Flutter Package on pub.dev
Summary
Aikido reports finding XCSSET in universal_file_viewer 0.1.5 on pub[.]dev. Malicious hooks are confined to the package's example projects, so the reported risk is to users who clone and build the example.
Key points
- Aikido says it found an XCSSET variant in universal_file_viewer 0.1.5, a Flutter package with about 500 downloads, and traced it to a compromised maintainer machine and GitHub repository.
- The package's Dart library code is clean; infected files are in example/ and are not compiled when the package is used as a dependency. The described risk is to users who clone and build the example app.
- Injected Android Gradle and Apple project build hooks contact C2 servers, including 5yotmxcc54l9xda[.]ru, qdgs232i-q[.]ru, and ejntin6hkjt7gj2[.]ru.
- XCSSET propagation modules inject hooks into Android Gradle projects, Git pre-commit hooks, and Xcode projects, potentially infecting projects that are later built or committed.
- The described infection chain downloads a loader, decrypts an AppleScript payload using AES-256-CBC, and runs theft modules in memory.
- The article describes modules targeting browser credentials and session data, Telegram sessions, notes, clipboard contents, and files, plus persistence by replacing the Dock's Launchpad tile.
Article Details
- Attack Vectors
- A maintainer's infected machine added XCSSET build hooks to example projects, and the infected files were published in universal_file_viewer version 0.1.5.
- The Android Gradle hook, Xcode/macOS build rules, and injected Git pre-commit hooks re-triggered the infection when affected projects were built or commits were made.
- The hooks contacted C2 domains to retrieve scripts and modules; the malware collected browser credentials, cookies, session data, clipboard contents, and files for exfiltration.
- Defensive Notes
- The article reports that universal_file_viewer’s lib/ directory was clean and that its infected files were confined to example/; merely adding the package as a dependency and building an app did not trigger the hooks.
- The stated risk was to users who cloned the repository and explicitly built the infected example app locally.
- Inspect Gradle build files, Xcode project files, and .git/hooks/pre-commit for the article's described injected or obfuscated commands.
- Aikido recommends checking its central feed for the malware issue and triggering a manual rescan; it also recommends Safe Chain for package-install workflows.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | 5yotmxcc54l9xda[.]ru | XCSSET C2 domain contacted by the Android Gradle build hook. |
| DOMAIN | ejntin6hkjt7gj2[.]ru | XCSSET C2 domain referenced by the injected macOS Xcode build rule. |
| DOMAIN | qdgs232i-q[.]ru | XCSSET C2 domain referenced by the injected iOS Xcode build rule. |
MITRE ATT&CK
T1005 · Data from Local SystemThe malware collects browser and application data, clipboard contents, and files from targeted home-directory folders.T1027 · Obfuscated Files or InformationThe hooks obfuscate commands using hex or base64 and reconstruct command names at runtime.T1041 · Exfiltration Over C2 ChannelStolen data is sent to the C2 at /u using multipart POST.T1059.002 · AppleScriptThe loader executes modules in memory via osascript, and the run-only AppleScript loader decrypts and runs the payload.T1059.004 · Unix ShellInjected hooks run shell commands through sh, including commands that retrieve and execute C2-delivered scripts.T1071.001 · Web ProtocolsBuild hooks and theft modules use curl and HTTP POST requests to communicate with the C2.T1105 · Ingress Tool TransferThe malware downloads loaders, theft modules, binaries, and a repackaged Telegram app from its C2.T1115 · Clipboard DataThe clipboard module reads clipboard contents with pbpaste and exfiltrates them.T1195.002 · Compromise Software Supply ChainThe infected maintainer machine contributed XCSSET-injected files to the published universal_file_viewer package.T1204.002 · Malicious FileBuilding an infected project or making a commit triggers the injected build hook or pre-commit hook.T1539 · Steal Web Session CookieThe malware exfiltrates browser cookies and session tokens.T1555.001 · KeychainThe browser theft module removes Chrome's Safe Storage keychain entry to intercept the regenerated encryption key.T1555.003 · Credentials from Web BrowsersThe malware targets saved browser passwords and Firefox credentials, and collects browser data from Chrome and Safari.T1560.001 · Archive via UtilityThe Firefox theft module creates a ZIP archive of browser data before uploading it.
Malware
Vendors
Products
DartThis is the first compromised package we have detected on pub.dev, the official package repository for Dart and Flutter. Unlike the recent npm supply chain attacks you might be familiar with, this was not a case ofFlutterfound malware on. We detected a variant of XCSSET hiding inside universal_file_viewer (version 0.1.5), a Flutter file preview package on pub.dev with around 500 downloads. This is the first compromised package we haveGoogle Chromebrowser_remote: strips Chrome's Safe Storage keychain entry to intercept its re-generated encryption key, then exfiltrates saved passwords, cookies, and session tokensMozilla Firefoxfirefox_data: drops a native binary and exfiltrates Firefox credentialspub.devToday, pub.dev joins the list of package registries we have found malware on. We detected a variant of XCSSET hiding inside universal_file_viewer (version 0.1.5), a Flutter file preview package on pub.dev with aroundSafarisafari_remote: drops a fake Safari bundle and exfiltrates Safari's local dataTelegramtdesktop: kills Telegram, replaces it with a trojanized copy, and targets session datauniversal_file_viewerof package registries we have found malware on. We detected a variant of XCSSET hiding inside universal_file_viewer (version 0.1.5), a Flutter file preview package on pub.dev with around 500 downloads. This is theXcodeXCSSET is a macOS worm that spams a malicious build hook into every Android Gradle project, Xcode project, and git repository it can find on a compromised machine. The maintainer's machine was infected, and when they
Tools
dockutilIt downloads dockutil from the C2 (/d/dockutil_arm64 or /d/dockutil_amd64), ad-hoc signs it, and builds a fake app bundle under ~/Library/Caches/vyf[.]lttzw[.]snjgwq/. The bundle's Info.plist is patched to impersonateSafe ChainFor future protection, consider Aikido Safe Chain (open source). Safe Chain sits in your existing workflow, intercepting npm, npx, yarn, pnpm, and pnpx commands and checking packages against Aikido Intel before install.