How to remove XcodeSpy malware
Written by Tomas Meskauskas on (updated)
What is XcodeSpy?
XcodeSpy malware targets Apple developers and spreads through malicious (trojanized) Xcode projects (Run Script feature in Xcode IDE). Research shows that one of these malicious Xcode projects (called TabBarInteraction) supposedly includes features for animating the iOS Tab Bar.
It is likely that there is more than one trojanized Xcode project. Malicious code used by XcodeSpy can easily be hidden and launched in any third-party Xcode project.
XcodeSpy (or rather the backdoor it injects) can record audio using the microphone, video using camera, and keyboard input. It can also download and upload files.
As mentioned, XcodeSpy is distributed using the Run Script feature in Xcode IDE. Once a trojanized Xcode project (XcodeSpy) is launched, it installs the EggShell backdoor onto the operating system.
Then the attackers can use installed backdoor to record audio using the microphone, video using the camera, log keystrokes (record keyboard input), upload and download files. Cyber criminals often use hijacked microphones and cameras to record videos and audio that could be used to blackmail victims.
Cyber criminals frequently threaten to publish recorded material, unless victims pay a certain sum (typically, in a cryptocurrency).
The keystroke logging feature allows the attackers to record everything victims type with their keyboard. Therefore, cyber criminals can obtain data such as login credentials (usernames, email addresses, passwords) for various personal accounts (from social media to banking accounts), credit card details, social security numbers, bank account numbers, and so on.
Depending on the recorded data, it could be used to steal online accounts, identities, make fraudulent purchases, transactions, and for other malicious purposes. The extracted information could also be sold to third parties (other cyber criminals).
Additionally, the XcodeSpy/installed backdoor can be used to download files stored on the victim's computer, including personal documents, photos, videos, etc.
Cyber criminals may threaten to publish these files as well and ask for payment in return for not making stolen files publicly available, or they could try to monetize downloaded files in various other ways.
As mentioned in the previous paragraph, XcodeSpy can also upload files. Cyber criminals use this feature to spread malware and other unwanted software.
Note that XcodeSpy malware installs a user LaunchAgent for persistence (malware stays active even after system reboot).
| Name | XcodeSpy backdoor |
| Threat Type | Backdoor malware |
| Detection Names (EggShell backdoor) | Avast (MacOS:Eggshell-L [Trj]), BitDefender (Trojan.MAC.Generic.105295), ESET-NOD32 (A Variant Of OSX/EggShell.M), Kaspersky (HEUR:Backdoor.OSX.EggShell.a), Full List (VirusTotal) |
| Symptoms | Trojans-type malware is designed to stealthily infiltrate the victim's computer and remain silent, and thus no particular symptoms are clearly visible on an infected machine. |
| Distribution methods | Trojanized/third-party Xcode projects |
| Damage | Data, financial loss, loss of access to personal accounts, problems with browsing safety, online privacy |
| Malware Removal (Mac) | To eliminate possible malware infections, scan your Mac with legitimate antivirus software. Our security researchers recommend using Combo Cleaner. |
More examples of malicious software that cyber criminals use to attack Mac users are Silver Sparrow, Eleanor, and Proton.
In most cases, cyber criminals distribute malware with to steal personal information, which can be monetized in various ways, or to infect computers with additional malware (e.g., Trojans, ransomware) that would allow them to steal information or blackmail victims.
As mentioned, XcodeSpy spreads via shared malicious Xcode projects by abusing the Run Script feature. Therefore, Apple developers are strongly advised to check third-party Xcode projects for malicious Run Scripts while adopting them.
How did potentially unwanted applications install on my computer?
It is likely that at least one of the malicious Xcode projects used to distribute XcodeSpy backdoor is (or was) available for download on a code-hosting platform called GitHub. Various developer forums might be used as well.
Malware (including ransomware) is usually distributed via malspam campaigns, unofficial software activation ('cracking') tools, Trojans, dubious file/software download sources, and fake software updating tools.
When cyber criminals attempt to distribute malware via malspam campaigns, they send emails that contain malicious attachments or download links for malicious files. Typically, they disguise their emails as official and important. If recipients open the attached file (or a file downloaded via a website link), they cause installation of malicious software.
Cyber criminals commonly attach executable files (.exe), archive files such as RAR, ZIP, PDF documents, JavaScript files and Microsoft Office documents to their emails. Software 'cracking' tools supposedly activate licensed software illegally (bypass activation), however, they often install malicious programs and do not activate any legitimate installed software.
Trojans are other rogue programs that can cause chain infections. I.e., when a Trojan is installed on the operating system, it can install additional malware.
Free file hosting websites, freeware download websites, Peer-to-Peer networks (e.g., torrent clients, eMule), unofficial websites, and third party downloaders are examples of other sources that are used to distribute malware. Cyber criminals disguise malicious files as legitimate and regular. When users download and open them, they inadvertently infect their computers with malware.
Fake software updating tools install malicious software rather than updates/fixes for installed programs, or they exploit bugs/flaws of outdated software that is installed on the operating system.
How to avoid installation of potentially unwanted applications
In this case, users (Apple developers) are advised to check shared Xcode projects for malicious Run Scripts while adopting them. Additionally, download files or software only from official websites and using direct download links.
In case you are using another person's project, be sure that the source is reliable. Update or activate installed software using tools that its official developers provide. Never use any third-party, unofficial tools neither to update or activate the software.
Those tools can be malicious, and it is illegal to use third-party tools to activate licensed software. Additionally, do not trust irrelevant emails received from suspicious, unknown senders. If these emails contain attachments or website links, do not open or click them.
Remember that cyber criminals disguise their emails as official, important messages.
If your computer is already infected with PUAs, we recommend running a scan with Combo Cleaner Antivirus for macOS to automatically eliminate them.
Eggshell backdoor file detected as a threat on VirusTotal:
Instant automatic Mac malware removal:
Manual threat removal might be a lengthy and complicated process that requires advanced IT skills. Combo Cleaner is a professional automatic malware removal tool that is recommended to get rid of Mac malware. Download it by clicking the button below:
▼ DOWNLOAD Combo Cleaner for Mac
By downloading any software listed on this website you agree to our Privacy Policy and Terms of Use. To use full-featured product, you have to purchase a license for Combo Cleaner. Limited seven days free trial available. Combo Cleaner is owned and operated by Rcs Lt, the parent company of PCRisk.com read more.
Quick menu:
- What is XcodeSpy?
- STEP 1. Remove PUA related files and folders from OSX.
- STEP 2. Remove rogue extensions from Safari.
- STEP 3. Remove rogue add-ons from Google Chrome.
- STEP 4. Remove potentially unwanted plug-ins from Mozilla Firefox.
Video showing how to remove adware and browser hijackers from a Mac computer:
Potentially unwanted applications removal:
Remove potentially unwanted applications from your "Applications" folder:
Click the Finder icon. In the Finder window, select "Applications". In the applications folder, look for "MPlayerX", "NicePlayer", or other suspicious applications and drag them to the Trash. After removing the potentially unwanted application(s) that cause online ads, scan your Mac for any remaining unwanted components.
Remove adware-related files and folders
Click the Finder icon, from the menu bar. Choose Go, and click Go to Folder...
Check for adware generated files in the /Library/LaunchAgents/ folder:
In the Go to Folder... bar, type: /Library/LaunchAgents/
In the "LaunchAgents" folder, look for any recently-added suspicious files and move them to the Trash. Examples of files generated by adware - "installmac.AppRemoval.plist", "myppes.download.plist", "mykotlerino.ltvbit.plist", "kuklorest.update.plist", etc. Adware commonly installs several files with the exact same string.
Check for adware generated files in the ~/Library/Application Support/ folder:
In the Go to Folder... bar, type: ~/Library/Application Support/
In the "Application Support" folder, look for any recently-added suspicious folders. For example, "MplayerX" or "NicePlayer", and move these folders to the Trash.
Check for adware generated files in the ~/Library/LaunchAgents/ folder:
In the Go to Folder... bar, type: ~/Library/LaunchAgents/
In the "LaunchAgents" folder, look for any recently-added suspicious files and move them to the Trash. Examples of files generated by adware - "installmac.AppRemoval.plist", "myppes.download.plist", "mykotlerino.ltvbit.plist", "kuklorest.update.plist", etc. Adware commonly installs several files with the exact same string.
Check for adware generated files in the /Library/LaunchDaemons/ folder:
In the "Go to Folder..." bar, type: /Library/LaunchDaemons/
In the "LaunchDaemons" folder, look for recently-added suspicious files. For example "com.aoudad.net-preferences.plist", "com.myppes.net-preferences.plist", "com.kuklorest.net-preferences.plist", "com.avickUpd.plist", etc., and move them to the Trash.
Scan your Mac with Combo Cleaner:
If you have followed all the steps correctly, your Mac should be clean of infections. To ensure your system is not infected, run a scan with Combo Cleaner Antivirus. Download it HERE. After downloading the file, double click combocleaner.dmg installer. In the opened window, drag and drop the Combo Cleaner icon on top of the Applications icon. Now open your launchpad and click on the Combo Cleaner icon. Wait until Combo Cleaner updates its virus definition database and click the "Start Combo Scan" button.
Combo Cleaner will scan your Mac for malware infections. If the antivirus scan displays "no threats found" - this means that you can continue with the removal guide; otherwise, it's recommended to remove any found infections before continuing.
After removing files and folders generated by the adware, continue to remove rogue extensions from your Internet browsers.
Remove malicious extensions from Internet browsers
Remove malicious Safari extensions:
Open the Safari browser, from the menu bar, select "Safari" and click "Preferences...".
In the preferences window, select "Extensions" and look for any recently-installed suspicious extensions. When located, click the "Uninstall" button next to it/them. Note that you can safely uninstall all extensions from your Safari browser - none are crucial for regular browser operation.
- If you continue to have problems with browser redirects and unwanted advertisements - Reset Safari.
Remove malicious extensions from Google Chrome:
Click the Chrome menu icon 
(at the top right corner of Google Chrome), select "More Tools" and click "Extensions". Locate all recently-installed suspicious extensions, select these entries and click "Remove".
- If you continue to have problems with browser redirects and unwanted advertisements - Reset Google Chrome.
Remove malicious extensions from Mozilla Firefox:
Click the Firefox menu 
(at the top right corner of the main window) and select "Add-ons and themes". Click "Extensions", in the opened window locate all recently-installed suspicious extensions, click on the three dots and then click "Remove".
- If you continue to have problems with browser redirects and unwanted advertisements - Reset Mozilla Firefox.
Outstanding!
▼ Show Discussion