XCSSET Malware Resurfaces with v40 to Target macOS Developers via Xcode Projects

Palo Alto Networks’ Unit 42 has uncovered a major update to the long-standing XCSSET malware family. The newly identified version 40 (v40) specifically targets macOS developers by distributing malicious code through compromised Apple Xcode projects hosted on Git repositories. By embedding downloader scripts into benign source code, the threat actors behind XCSSET leverage developer build processes to achieve execution, hijack local development environments, and spread malware laterally across shared repositories.

Xcode Supply Chain Poisoning and Lateral Spreading

XCSSET leverages software supply chain contamination as its primary delivery vector. The threat actors compromise vulnerable Git repositories and inject a malicious downloader script into benign files within Xcode projects—typically exploiting customized build settings such as Xcode “Run Script” phases. When a developer downloads a poisoned repository and compiles the project, Xcode automatically executes the embedded script within the developer’s local security context.

Once execution is achieved on a developer’s workstation, XCSSET searches the local filesystem for other Xcode projects. It systematically infects these local codebases by injecting the same malicious build instructions. When the infected developer commits code, pushes updates, or shares projects with colleagues and open-source communities, XCSSET propagates to additional engineering environments. This self-propagating mechanism turns every infected developer workstation into an unwitting distribution vector.

Dual Attack Waves and Upgraded v40 Capabilities

Unit 42 observed XCSSET version 40 active in two distinct attack waves in mid-April and early May. While XCSSET has targeted macOS systems since at least 2021—previously exploiting zero-day vulnerabilities and incorporating cryptocurrency theft routines—version 40 expands its modular architecture to deploy 17 separate payload components. These modules enable credential harvest, keystroke logging, clipboard manipulation, browser hijacking, and data exfiltration.

Version 40 introduces two key modules:

• Chrome CDP Hijacker: The malware wraps the official Google Chrome executable in a malicious launcher that starts Chrome with the Chrome DevTools Protocol (CDP) enabled on a local port. By leveraging CDP, XCSSET fetches malicious JavaScript directly from C2 infrastructure, enabling real-time interception of web traffic, credentials, session cookies, and Web3 assets like MetaMask transactions. Additionally, CDP abuse enables a fileless reverse shell; while Google currently blocks this behavior in Chrome for Windows, protections for macOS remain in development.
• Telegram Trojanizer: The malware locates and deletes the legitimate Telegram Desktop application on the infected host, replacing it with a malicious executable designed to intercept victim communications.

Evasion Mechanics and OS Defense Neutralization

To evade endpoint detection tools and bypass macOS operating system controls, XCSSET v40 relies heavily on dynamic loader obfuscation and active security suppression. The C2 server periodically re-compiles the malware loader binary so that file signatures continuously change. Network traffic utilizes separate, build-unique encryption keys for inbound and outbound communication, while internal variables, function names, and strings are heavily obfuscated.

At the host level, XCSSET aggressively neuters built-in macOS defensive controls:

• Disables native security tools, including XProtect and the Malware Removal Tool (MRT).
• Bypasses and tampers with the Transparency, Consent, and Control (TCC) framework to bypass privacy prompts.
• Suppresses Apple’s Rapid Security Response (RSR) patches and prevents XProtect signature database updates.
• Terminates Apple’s CloudTelemetryService process to block diagnostic and error reporting to security operations teams.

Enterprise Blast Radius

Developer workstations represent high-value enterprise targets because software engineers hold elevated privileges, access SSH keys, manage cloud credentials, and possess write access to primary source code repositories. An undetected XCSSET infection on a single engineering endpoint risks compromising sensitive tokens and internal codebases. In environments where developer code feeds directly into automated CI/CD pipelines, an infection can escalate into a downstream software supply chain attack affecting thousands of end users.

Defensive Actions and Detection Guidance

Mitigating XCSSET v40 requires strict verification of build configurations and endpoint process activity on macOS systems:

• Inspect Xcode Build Phases: Audit all project.pbxproj configuration files and build phase scripts in third-party or open-source repositories for unverified bash or AppleScript invocations before compiling locally.
• Monitor System Telemetry: Hunt for anomalous osascript execution, unauthorized modifications to macOS defaults domains, and ad hoc-signed binaries attempting to bypass Gatekeeper execution controls.
• Audit Browser Launch Arguments: Flag invocations of Google Chrome that include flags enabling debugging interfaces, such as --remote-debugging-port.
• Implement Dependency Controls: Scan open-source code dependencies and build scripts automatically within developer pipelines to catch injected downloader scripts before execution.