According to the latest report from network security company SentinelOne, the new version of the XLoader malicious tool has been recompiled using C and Objective C languages and signed by Apple developers. Attackers further disguised the XLoader malicious tool as a Microsoft Office productivity application called "OfficeNote" and distributed it through an application called "OfficeNote.dmg".

The report states that although Apple has revoked the developer account, Apple's malicious software interception tool XProtect did not prevent the application from running. This malicious software targets Chrome and Firefox browsers and then steals information stored in the user's clipboard through Apple's own API.