ATP28 operators have upped their game – the Xagent payload now can target victims running Mac OS X to steal passwords, grab screens and steal iPhone backups stored on the Mac.

https://labs.bitdefender.com/2017/02/new-xagent-mac-malware-linked-with-the-apt28/