A New Variant of XCSSET Malware Targets macOS Developers with Compromised Xcode Projects
A sophisticated piece of malware called XCSSET has resurfaced, this time targeting thousands of macOS users through compromised Xcode projects and GitHub repositories. The malware’s infection chain is complex, but essentially, it spreads by injecting a downloader script into benign files within Xcode projects, allowing developers to unwittingly download the malicious code when they build their projects.
XCSSET has been around since at least 2021, but this new variant, dubbed version 40, features enhanced evasion techniques and two new components. Researchers at Palo Alto Networks’ Unit 42 analyzed the infection chain and found that the threat actor compromises vulnerable Git repositories to spread the malware. Once a developer downloads the compromised project, they become infected upon building it, allowing XCSSET to compromise every other Xcode project on their system and propagate further through shared source code.
The researchers observed two distinct attack waves in mid-April and early May, using XCSSET version 40. The attacks follow a four-stage infection chain before deploying 17 separate modules that enable credential theft, keystroke logging, clipboard manipulation, browser hijacking, and data exfiltration. The newest version features two new modules: a Chrome hijacker and a Telegram trojanizer.
The Chrome hijacker wraps the Chrome browser in a malicious launcher and enables the Chrome DevTools Protocol (CDP) on a local port to fetch JavaScript from the attacker’s command-and-control infrastructure. This allows attackers to intercept web traffic, including credentials, cookies, and MetaMask transactions, which can be manipulated on the fly to divert payments. The hijacker module also enables system command execution via a fileless reverse shell.
The Telegram trojanizer deletes the legitimate Telegram Desktop application on infected systems and replaces it with a malicious version, potentially used for intercepting victims’ communications. Unit 42 could not retrieve the encrypted configuration of this module, so its exact functionality remains unknown.
XCSSET’s new detection-evasion measures include periodically re-compiling the loader on the C2 server, using separate encryption keys for inbound and outbound communications, and obfuscating function names, variables, and strings with build-unique ciphers. The malware aggressively attempts to disable macOS security features such as XProtect, MRT, TCC, and Rapid Security Response.
To defend against this latest variant of XCSSET, researchers recommend monitoring for anomalous AppleScript activity, unauthorized browser modifications, suspicious macOS defaults domains, and ad hoc-signed applications that bypass Gatekeeper. They also suggest scanning open-source dependencies to prevent compromised repositories from entering software development pipelines.
In the long run, the best defense is a layered one – ensure that every layer of your security stack is tested regularly to prevent attackers from slipping by detection. This includes testing your SIEM and EDR rules with breach and attack simulation techniques. By staying vigilant and proactive, you can keep your macOS systems secure in the face of sophisticated threats like XCSSET.
Source: Bleeping Computer — 2026-08-04