XagentOSX reuses leaked HackingTeam injection code

Analysis of APT28's XagentOSX/Komplex.B macOS malware shows its unused code-injection routine was copied nearly verbatim from HackingTeam's leaked RCS implant source code.

Researchers analyzed a Mac malware sample (XagentOSX, also called Komplex.B) linked to APT28/Sofacy, following earlier writeups from BitDefender and Palo Alto Networks Unit42 that tied the sample to the Komplex downloader. While the binary contains a class called InjectApp implementing macOS process-injection via AppleScript/SBApplication AppleEvents, deeper analysis found that this injection code is never actually invoked by any code path in the malware, and had to be triggered manually by patching the instruction pointer in a debugger.

Comparing the disassembled injection logic against HackingTeam's publicly leaked RCS macOS implant source code (from the 2015 HackingTeam breach) revealed matching method names, matching parameter lists, an identical hardcoded blacklist array (appBListArray) with the same values, and even the same logic bugs (a broken nil-check in isInjectable) and leftover dead code (a pointless lock/unlock and a string comparison that can never be true) stemming from incomplete removal of HackingTeam's TaskManager class. These artifacts strongly indicate the XagentOSX authors directly copy-pasted HackingTeam's injection code rather than independently reimplementing the same technique.

The finding suggests a code-sharing or reuse relationship between HackingTeam's leaked commercial spyware and a Russian-attributed espionage toolset, though the analyst notes attribution of motive (purchase vs. use of leaked source) cannot be confirmed. The injection capability itself was not active in the sample studied, so it represents a latent/unused feature rather than an in-the-wild technique.

Source reporting: https://objective-see.org/blog/blog_0x18.html