A New Variant of XCSSET Malware Targets macOS Developers through Compromised Xcode Projects
Thousands of macOS users are at risk after a new version of the XCSSET malware was discovered targeting developers through compromised Xcode projects and GitHub repositories. This variant, known as v40, has been found to have enhanced evasion techniques and introduces two new components that allow attackers to compromise entire development environments.
Xcode is the official software development kit (SDK) for creating, testing, and publishing software on Apple’s platforms. The malware spreads by compromising vulnerable Git repositories and injecting a downloader script into benign files within Xcode projects. When developers download these compromised projects, they become infected upon building them, allowing XCSSET to compromise every other Xcode project on the system and propagate further through shared source code.
The infection chain is quite complex, with four stages before deploying 17 separate modules that enable credential theft, keystroke logging, clipboard manipulation, browser hijacking, and data exfiltration. The new version of XCSSET features two new modules: a Chrome hijacker and a Telegram trojanizer. The hijacker module wraps the Chrome browser in a malicious launcher, enabling the Chrome DevTools Protocol (CDP) on a local port to fetch JavaScript from the attacker’s command-and-control infrastructure.
This allows attackers to intercept web traffic, including credentials, cookies, and MetaMask transactions, which can be manipulated on the fly to divert payments. The hijacker module also enables system command execution via a fileless reverse shell, which is currently blocked by Google in Chrome for Windows but not yet protected against on macOS.
In addition to these new modules, XCSSET has implemented several detection-evasion measures, including periodically re-compiling the loader on the C2 server and using separate encryption keys for inbound and outbound communications. The malware also aggressively attempts to disable macOS security features such as XProtect, MRT, TCC, and Rapid Security Response.
Researchers at Palo Alto Networks’ Unit 42 recommend monitoring for anomalous AppleScript activity, unauthorized browser modifications, suspicious macOS defaults domains, and ad hoc-signed applications that bypass Gatekeeper. To defend against the latest version of XCSSET, security teams are advised to scan open-source dependencies to prevent compromised repositories from entering software development pipelines.
The fact that this malware is targeting developers through their own projects highlights the importance of supply chain security. As more companies rely on open-source code and cloud-based development tools, the risk of compromise increases. By staying vigilant and monitoring for suspicious activity, developers can help protect themselves and their colleagues from falling victim to this type of attack.
In particular, it’s essential to test every layer of the software development process before attackers do. With 54% of successful attacks going undetected, security teams must prioritize breach and attack simulation testing to ensure that their SIEM and EDR rules are effective in detecting threats.
Source: Bleeping Computer — 2026-08-04