XAgentOSX: Sofacy’s XAgent macOS Tool
Summary: Unit 42 found a macOS backdoor it calls XAgentOSX, which shares the XAgent name with a Sofacy Windows trojan and was built by the same actor, based on matching project paths under /Users/kazak/Desktop/Project/. The trojan receives commands over HTTP GET requests, sends data via HTTP POST encrypted with RC4, logs keystrokes through CGEventTapCreate, and identifies each host by the first four bytes of its IOPlatformUUID.
Bottom line: The sample's command handler covers 19 commands, including one that checks whether the Mac was used to back up an iPhone or iPad, and its C2 IP 23.227.196[.]215 sits one address away from the 23.227.196[.]217 that CrowdStrike tied to Sofacy's XTunnel payload in the DNC attack.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026