# XCSSET Malware Resurfaces, Targeting macOS Developers via Compromised Xcode Projects **XCSSET**, a persistent **macOS** malware, has resurfaced with an updated version (v40) that employs enhanced evasion techniques and introduces new modules for credential theft and system compromise. This latest iteration is distributed through compromised **Xcode** projects and **GitHub** repositories, posing a significant threat to software developers. ## The Infection Vector: Compromised Xcode Projects Researchers at **Palo Alto Networks' Unit 42** have analyzed the infection chain, revealing that threat actors inject a downloader script into benign files within vulnerable Git repositories. When developers download and build these compromised **Xcode** projects, their systems become infected. The malware then spreads to other **Xcode** projects on the system, leveraging shared source code for further propagation.  **Unit 42** observed **XCSSET** v40 in two distinct attack waves in mid-April and early May, indicating an active and evolving threat. ## A History of Sophistication **XCSSET** has been targeting **macOS** systems since at least 2021, and in some instances, has exploited zero-day vulnerabilities. In September 2025, **Microsoft** warned of an **XCSSET** campaign utilizing compromised **Xcode** projects. **Microsoft** had also previously identified a variant of the malware with cryptocurrency-theft capabilities. ## Multi-Stage Attack Chain and New Modules In the attacks analyzed by **Unit 42**, **XCSSET** follows a four-stage infection chain before deploying 17 separate modules. These modules facilitate a wide range of malicious activities, including credential theft, keystroke logging, clipboard manipulation, browser hijacking, and data exfiltration.  The newest **XCSSET** version introduces two particularly notable modules: a **Chrome** hijacker and a **Telegram** trojanizer. ### The Chrome Hijacker The **Chrome** hijacker module wraps the browser in a malicious launcher and enables the **Chrome DevTools Protocol (CDP)** on a local port. This allows the attacker to fetch malicious JavaScript from their command-and-control (**C2**) infrastructure. The injected code can then intercept web traffic, including credentials, cookies, and even **MetaMask** transactions, enabling on-the-fly manipulation to divert payments. Furthermore, this module facilitates system command execution via a fileless reverse shell. While **Google** blocks this functionality in **Chrome** for **Windows**, efforts are underway to extend these protections to **macOS**.  ### The Telegram Trojanizer The **Telegram** trojanizer module deletes the legitimate **Telegram Desktop** application on infected systems and replaces it with a malicious version. While its exact functionality remains unknown due to an encrypted configuration, it is likely used for intercepting victims’ communications. ## Enhanced Evasion Techniques **XCSSET** v40 incorporates new detection-evasion measures, including: * Periodically re-compiling the loader on the **C2** server. * Utilizing separate encryption keys for inbound and outbound communications. * Obfuscating function names, variables, and strings with build-unique ciphers. The malware also aggressively attempts to disable **macOS** security features such as **XProtect**, **MRT**, **TCC**, and **Rapid Security Response**. It terminates **Apple’s CloudTelemetryService** and prevents **XProtect** signature updates, highlighting its determination to remain undetected. ## Recommendations for Defense **Unit 42** recommends several measures to defend against **XCSSET**: * Monitor for anomalous **AppleScript** activity. * Watch for unauthorized browser modifications. * Look for suspicious **macOS** defaults domains. * Identify ad hoc-signed applications that bypass **Gatekeeper**. * Scan open-source dependencies to prevent compromised repositories from entering software development pipelines.