A new version of the XCSSET malware, tracked as v40, is targeting thousands of macOS users through compromised Xcode projects and GitHub repositories, according to research from Palo Alto Networks’ Unit 42. The malware spreads when developers build infected projects, and it then compromises every other Xcode project on the system, propagating through shared source code.
How XCSSET v40 Spreads Through Compromised Xcode Projects and GitHub
Unit 42 observed XCSSET v40 in two distinct attack waves earlier this year, with the threat actor compromising vulnerable Git repositories and injecting a downloader script into benign files within Xcode projects. A developer who builds one of the infected projects becomes infected, and XCSSET then goes on to compromise every other Xcode project on the machine, using shared source code to move between projects and onward.
The Four-Stage Infection Chain and Its 17 Modules
The attack relies on a four-stage infection chain that deploys 17 modules for credential theft, keystroke logging, clipboard manipulation, browser hijacking, and data exfiltration. Two of the modules are new to this version: a Chrome hijacker and a Telegram trojanizer.
The New Chrome Hijacker and Telegram Trojanizer Modules
The Chrome hijacker wraps Chrome in a malicious launcher and enables the Chrome DevTools Protocol on a local port to fetch JavaScript from the command-and-control server. That interception lets the malware capture traffic including credentials and cookies, and it can also intercept MetaMask transactions and manipulate them on the fly to divert cryptocurrency payments, while enabling a fileless reverse shell.
Telegram Trojanizer and Communication Interception
The Telegram trojanizer deletes the legitimate Telegram Desktop application and replaces it with a malicious version, potentially intercepting all communications that flow through the messaging app. The two new modules reflect a focus on intercepting both browser-based financial activity and messaging traffic.
Evasion Tactics and the Disabling of macOS Security
XCSSET v40 introduces several new evasion techniques, including re-compiling the loader on the command-and-control server, using separate encryption keys for inbound and outbound traffic, and generating build-unique ciphers. The malware aggressively disables macOS security protections, including XProtect, Malware Removal Tool, Transparency Consent and Control, and Rapid Security Response, terminates the CloudTelemetryService, and prevents XProtect signature updates.
The Zero-Day History and Continued macOS Targeting
XCSSET has targeted macOS since at least 2021 and has exploited zero-day vulnerabilities in some attacks, and Microsoft warned of an XCSSET campaign using compromised Xcode projects in the prior year. The sustained development of the malware, now at version 40 with new modules and evasion, shows an active and evolving threat aimed specifically at the Apple developer ecosystem.
What XCSSET v40 Means for macOS Developers
The attack targets the source of macOS software itself: developers who build compromised open-source projects hand their machines to the attacker, and the module set enables theft of credentials, keystrokes, browser data, and cryptocurrency wallet transactions. Because the malware spreads through shared source code, the compromise can propagate from a single developer to every team member and project that shares code.
The Browser, Messaging, and Wallet Interception Focus
The two new modules show where the operator’s interest lies. The Chrome hijacker intercepts credentials and cookies in normal browsing and can manipulate MetaMask transactions in real time to divert cryptocurrency payments, while the Telegram trojanizer replaces the legitimate messaging app with a malicious copy to intercept communications. Together they give the operator a broad view of the victim’s financial activity and private messaging, collected from the tools developers use daily.
Detecting XCSSET v40 on Affected Systems
Unit 42 recommends monitoring for anomalous AppleScript activity, unauthorized browser modifications, suspicious macOS defaults domains, and ad-hoc-signed applications that bypass Gatekeeper, and scanning open-source dependencies to keep compromised repositories out of development pipelines. The malware’s aggressive disabling of XProtect and related protections means detection may need to rely on these behavioral signals rather than signature updates that the malware itself can block.
For the macOS ecosystem, the XCSSET v40 campaign points to the supply-chain risk that sits one layer above the OS itself. A developer’s trust in an open-source project they build can become the entry point for malware that then spreads to every other project on the machine. The addition of browser and messaging interception modules shows the operator is interested in financial gain through transaction diversion as much as in data theft, and the aggressive disabling of native macOS protections makes the infection difficult to detect and remove once installed. The version and module growth over time indicates an actor that regards macOS developers as a durable, high-value target.
