Russian cyberspies known as APT28 have created a Mac version of their famous XAgent, Sofacy, malware. XAgentOSX is a modular version of the XAgent trojan, which already has versions for Windows, iOS, and Android. The group behind these attacks is identified by security firms under the primary name of APT 28, but also under the names of Sednit, Fancy Bear, Pawn Storm, Tsar Team, and Strontium. The main feature appears to be the component that can search and steal iPhone backups.
Source: https://www.bleepingcomputer.com/news/security/mac-malware-linked-to-infamous-russian-cyber-espionage-group/