A new variant of the XCSSET malware, designated v40, has been observed targeting macOS developers through compromised Xcode projects and GitHub repositories. This updated version, which resurfaced after months of inactivity, incorporates enhanced evasion techniques and introduces two new malicious components.
Researchers at Palo Alto Networks' Unit 42 analyzed the infection chain and reported that the threat actor compromises vulnerable Git repositories to inject a downloader script into benign files within Xcode projects. Developers who download and build these compromised projects become infected. The malware then propagates by compromising other Xcode projects on the system and spreading through shared source code.
Unit 42 observed XCSSET version 40 in two distinct attack waves, occurring in mid-April and early May. XCSSET has been active since at least 2021, with past campaigns, including one reported by Microsoft in September 2025, also leveraging compromised Xcode projects for distribution. Previous variants have also included cryptocurrency-theft capabilities.
The infection process for the latest XCSSET variant involves a four-stage chain, culminating in the deployment of 17 separate modules. These modules facilitate credential theft, keystroke logging, clipboard manipulation, browser hijacking, and data exfiltration.
Two notable new modules in version 40 are a Chrome hijacker and a Telegram trojanizer. The Chrome hijacker wraps the browser in a malicious launcher and activates the Chrome DevTools Protocol (CDP) on a local port. This allows the malware to fetch JavaScript from the attacker's command-and-control (C2) infrastructure, enabling the interception and manipulation of web traffic, including credentials, cookies, and MetaMask transactions. The hijacker also supports system command execution via a fileless reverse shell, a capability that Google has blocked in Chrome for Windows and is working to extend to macOS.
The Telegram trojanizer module is designed to delete the legitimate Telegram Desktop application from infected systems and replace it with a malicious version. While Unit 42 could not retrieve its encrypted configuration, the suspected purpose is to intercept victim communications.
XCSSET v40 also implements new detection evasion measures. These include periodic re-compilation of the loader on the C2 server, the use of separate encryption keys for inbound and outbound communications, and the obfuscation of function names, variables, and strings with build-unique ciphers. The malware aggressively attempts to disable macOS security features such as XProtect, MRT, TCC, and Rapid Security Response, terminates Apple's CloudTelemetryService, and prevents XProtect signature updates.
To defend against this threat, Unit 42 recommends monitoring for anomalous AppleScript activity, unauthorized browser modifications, suspicious macOS defaults domains, and ad hoc-signed applications that bypass Gatekeeper. Additionally, scanning open-source dependencies is advised to prevent compromised repositories from entering software development pipelines.
