{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/x-agent/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":[],"_cs_severities":["medium"],"_cs_tags":["malware","backdoor","macos","x-agent"],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eThreatFox has reported three new file indicators associated with the X-Agent (OSX) malware family. X-Agent is a modular backdoor historically utilized in espionage campaigns. These indicators are identified as payloads and were first observed on November 4, 2026.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eIngest the provided SHA-256 and MD5 file hashes into endpoint detection and response (EDR) blocklists.\u003c/li\u003e\n\u003cli\u003ePerform retrospective hunting across all managed macOS endpoints for the presence of these file hashes.\u003c/li\u003e\n\u003cli\u003eEnsure file integrity monitoring (FIM) is active on critical system paths to detect unauthorized executable deployment.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-05T13:32:50Z","date_published":"2026-11-05T13:32:50Z","id":"https://feed.craftedsignal.io/briefs/2026-11-x-agent-indicators/","summary":"Three new file hashes associated with the X-Agent macOS backdoor were identified and added to ThreatFox on November 4, 2026.","title":"X-Agent modular backdoor file indicators","url":"https://feed.craftedsignal.io/briefs/2026-11-x-agent-indicators/"}],"language":"en","title":"CraftedSignal Threat Feed - X-Agent","version":"https://jsonfeed.org/version/1.1"}