XCSSET v40 Resurfaces, Hits macOS Devs Via Poisoned Xcode

Security researchers have identified a new version of the XCSSET malware family, tracked as v40, spreading through compromised Xcode projects and vulnerable Git repositories. Analysts at Palo Alto Networks' Unit 42 documented the campaign in a detailed technical report.

BleepingComputer separately confirmed that the updated malware is reaching thousands of macOS users through GitHub-hosted projects. The malware resurfaced after months of inactivity. This latest iteration introduces stronger evasion mechanisms alongside two entirely new attack modules.

XCSSET is a modular macOS malware family that was first documented by Trend Micro in 2020. It primarily targets software developers by infecting Xcode projects, Apple's software development kit used to build applications for macOS, iOS, and other Apple platforms.

Attackers inject a malicious downloader script into otherwise legitimate project files. They then distribute the poisoned projects via Git repositories, including public ones hosted on GitHub. A developer becomes infected the moment they build the tampered project locally.

At that point, XCSSET spreads itself to every other Xcode project stored on that machine. This allows it to propagate further whenever code is shared with colleagues or pushed to shared repositories.

Unit 42 observed two distinct waves of XCSSET v40 activity: the first in mid-April 2026 and the second in early May 2026, which introduced an expanded set of modules. The researchers noted a particular concentration of targeting against developers in South Asia, a pattern that is consistent with the malware's original 2020 victimology.

XCSSET's operators have steadily expanded the malware's toolkit over several years. Each documented version has added new theft or evasion techniques:

• In 2021, Apple patched a macOS zero-day vulnerability (CVE-2021-30713) in the Transparency, Consent and Control (TCC) framework. Jamf researchers had found that XCSSET was actively exploiting it to bypass privacy protections and take unauthorized screenshots of victims' desktops.
• In February 2025, Microsoft identified a variant with enhanced obfuscation and new persistence methods based on .zshrc files and Dock manipulation. The variant also included updated Xcode infection techniques targeting cryptocurrency wallets and Notes app data.
• In September 2025, Microsoft flagged a further variant that added a modified build of the open-source HackBrowserData tool to steal Firefox browser data. This variant also included a clipboard hijacker that silently swaps copied cryptocurrency wallet addresses for one controlled by the attacker.

Version 40 builds directly on this trajectory. Unit 42's analysis shows the threat actor has moved toward an architecture that leaves almost no trace on disk.

Inside the v40 Infection Chain

According to Unit 42, XCSSET v40 executes through four distinct stages before its final payload becomes active. An initial loader script establishes contact with the attacker's command-and-control (C2) infrastructure. A second stage fingerprints the compromised system and retrieves further modules.

A third stage uses a temporary staging application to load the core malware into memory. A fourth stage runs the core orchestrator module, internally named "boot." Once this memory-resident core begins running, the malware deletes its installation files from disk and continues operating almost entirely in volatile memory. This significantly complicates detection and forensic analysis.

From this orchestrator, XCSSET v40 can deploy 17 distinct modules covering credential theft, keystroke logging, clipboard manipulation, data exfiltration, and browser hijacking. Two of these modules are new to this version.

The most notable addition is a Chrome hijacking backdoor that abuses the legitimate Chrome DevTools Protocol (CDP). The malware wraps the genuine Google Chrome binary in a malicious launcher. When a victim opens the browser, the wrapper relaunches Chrome with command-line flags that enable CDP on a local port.

A companion binary then connects to that port to execute arbitrary JavaScript in the browser. This allows attackers to intercept credentials, cookies, and MetaMask cryptocurrency transactions in real time, and even manipulate wallet transactions on the fly.

The same module can also open a fileless reverse shell by passing disguised commands via browser console logging events. This allows attackers to execute system commands directly within the hijacked browser process.

BleepingComputer noted that Google already blocks this type of CDP abuse in Chrome for Windows and is working to extend the same protection to macOS.

The second new component is a Telegram Desktop trojanizer. This module deletes the legitimate Telegram application on an infected Mac and replaces it with a malicious version supplied by the C2 server. It then forces the original process to close, so the victim unknowingly relaunches the trojanized copy.

Unit 42 could not recover the module's encrypted configuration file during its collection window, so the exact scope of data it targets remains unconfirmed. The researchers assess, though, that it likely tracks Telegram-related markers on each infected host.

XCSSET v40 also introduces a defense-evasion framework built around several overlapping techniques. The malware's loader binary is recompiled on the attacker's server every few hours, producing dozens of unique file hashes for the same functional code.

Individual modules are also encrypted using separate keys for inbound and outbound traffic, and further obfuscated with per-build string ciphers.

On the endpoint itself, the malware attempts to actively undermine macOS's built-in defenses. It disables the SoftwareUpdate channel that keeps security databases such as XProtect, MRT, and TCC current. It also terminates Apple's CloudTelemetryService to block security data from reaching Apple.

It then locks the XProtect signature database with an exclusive file lock so that even a successful update cannot be written to disk. It also resets the TCC permission database and re-displays a fake system prompt to trick users into re-granting automation access after they have denied it.

Both Unit 42 and BleepingComputer emphasize that supply-chain hygiene remains the most effective defense against this malware family. Recommended precautions include:

• Scanning open-source dependencies and Xcode projects for injected code before building them, particularly those pulled from unfamiliar Git repositories.
• Monitoring for unusual AppleScript activity, unauthorized browser launcher modifications, unexpected macOS defaults domains, and ad hoc-signed applications that bypass Gatekeeper.

Developers who regularly clone or share Xcode projects are advised to manually inspect build scripts and project files before compiling unfamiliar code. They should also keep macOS and Xcode fully updated, and treat any sudden changes in Telegram or Chrome behavior as a potential sign of compromise.

Because XCSSET has a documented history of exploiting Apple zero-day vulnerabilities to expand its reach, prompt installation of macOS security updates also remains an important line of defense against this evolving threat.