Full research report
New XCSSET variant targets macOS devs via compromised Xcode projects
Executive assessment
XCSSET v40 represents a significant maturation of a malware family active since 2020, now featuring fully memory-resident operations, per-build polymorphic loader regeneration, and two new capability modules that extend its reach into browser sessions and messaging applications. The Chrome DevTools Protocol abuse is the most operationally significant novel technique: by wrapping the Chrome binary and enabling CDP on a local port, the malware creates a fileless reverse-shell channel running through a trusted process, making it difficult to detect through conventional process-tree or file-system analysis. The supply-chain distribution mechanism—infecting shared Xcode project repositories to reach developers and, transitively, their application users—substantially amplifies the campaign's potential reach beyond the initial set of compromised maintainers. Operator OPSEC failures, including reuse of SSL certificates and SSH keys across infrastructure, have allowed researchers to correlate the two attack waves and map the C2 estate; this represents a defensive opportunity for retrospective hunting. The Telegram trojanizer's capability remains partially unknown, leaving open whether it targets communications interception, credential harvesting, or further lateral propagation.
What happened
A new variant of the XCSSET malware family, designated v40, emerged in mid-April 2026 and conducted a second, expanded attack wave in early May 2026, targeting macOS software developers through compromised Xcode projects and GitHub repositories. The malware is distributed by injecting a downloader script into legitimate Xcode project files; developers who clone and build affected projects become infected, after which XCSSET propagates to all other Xcode projects on the same system. Unit 42 published a detailed technical analysis on 31 July 2026 covering the infection chain, 17 deployed modules, and two newly introduced components. The family has been active since at least 2020, with prior variants independently documented by Microsoft Threat Intelligence in March and September 2025.
Affected scope
macOS developers using the Xcode integrated development environment; any Xcode project hosted in or cloned from a compromised Git repository; downstream users of applications built from infected projects. Developers in South Asia are identified as the primary geographic targets in this campaign. No restrictions to specific macOS versions are noted in published research.
Technical assessment
XCSSET v40 executes a four-stage infection chain that terminates with a memory-resident orchestrator loading 17 specialised modules without leaving disk artifacts after installation. Two new modules distinguish this variant: a Chrome hijacker that wraps the Chrome browser binary, enables the Chrome DevTools Protocol on a local port, and injects JavaScript into active browser sessions to intercept credentials, session cookies, and cryptocurrency wallet transactions while providing a fileless reverse-shell channel through the browser process; and a Telegram trojanizer that replaces the legitimate Telegram Desktop application with a malicious version whose full capability is unconfirmed. The loader binary is recompiled on attacker-controlled infrastructure every few hours with unique encryption keys and obfuscation ciphers, generating polymorphic hashes that frustrate signature-based detection. The malware actively sabotages macOS security controls, including XProtect signature-database writes, MRT, TCC permissions, and CloudTelemetryService telemetry.
Recommended defensive actions
- Audit all Xcode projects and cloned Git repositories for unexpected additions to build phase scripts or embedded downloader scripts before compiling.
- Monitor macOS endpoints for anomalous AppleScript process activity, Chrome launching from an unexpected binary path, and unauthorised creation or modification of macOS defaults preference domains.
- Scan open-source dependencies and third-party repository inputs with automated supply-chain tooling to detect injected scripts before they enter development workflows.
- Verify the code-signing identity and bundle integrity of the Chrome and Telegram Desktop installations on developer machines; investigate any ad hoc-signed or unsigned application variants.
- Block known XCSSET C2 indicators at the network perimeter, including the 40 C2 domains (.ru and .in registrations) and seven IP addresses published in the Unit 42 IOC list.
- Update macOS to the latest release and ensure Rapid Security Response updates are applied, then monitor for any process that prevents XProtect database writes or terminates CloudTelemetryService.
Uncertainties and evidence gaps
- The identity and attribution of the threat actor behind XCSSET v40 has not been publicly established.
- The full capability of the Telegram trojanizer module is unknown; Unit 42 could not retrieve its encrypted configuration.
- The precise number of compromised repositories and the total population of affected developers and downstream application users has not been publicly quantified.
- Whether Google's planned extension of Windows-side Chrome DevTools Protocol protections to macOS will be effective against this specific technique once deployed is unconfirmed.
Vulnerability flow
Defender-oriented path reconstructed only from sourced report findings. Unknown stages are omitted.
Active malware campaign confirmed across two distinct attack waves (mid-April and early May 2026); no specific CVE exploitation identified; malware spreads via supply-chain compromise of Xcode project repositories targeting macOS developers.
The investigation began with the BleepingComputer article, which attributed the findings to Unit 42 and provided sufficient detail to locate the primary research publication directly. Fetching the Unit 42 report confirmed the technical architecture, attack timeline, IOCs, and absence of CVEs. A targeted search for prior XCSSET advisories returned the Microsoft Security Blog's September 2025 report, which was fetched and confirmed as independent institutional corroboration of the supply-chain distribution mechanism. Two further articles—from CybersecurityNews and GBHackers—were fetched as independent outlets and contributed additional detail on the CDP reverse-shell technique and operator OPSEC failures respectively. No CVEs, public proof-of-concept code, or threat-actor attribution were identified across any source; the campaign is assessed as confirmed active exploitation of developer trust in shared repositories, with high confidence.
- Does the BleepingComputer article exist and what are its principal claims?Fetched the BleepingComputer article supplied in the source material.bleepingcomputer.com ↗
Article confirmed as live; describes XCSSET v40, two attack waves (mid-April and early May 2026), Chrome hijacker, Telegram trojanizer modules, and Unit 42 as the attributing researcher. No CVEs stated.
why Establishes the story is real and identifies Unit 42 as the primary research source, directing the next step.
- Where is the Unit 42 primary research publication and does it exist?Searched for 'XCSSET v40 Unit 42 macOS Xcode 2026 analysis' to locate the original report URL.
Unit 42 report identified at unit42.paloaltonetworks.com/xcsset-v40-malware-analysis/, published 31 July 2026.
why Locates the authoritative primary source whose findings underpin the entire story.
- What does the Unit 42 report contain on the infection chain, modules, IOCs, and CVEs?Fetched the Unit 42 research article.unit42.paloaltonetworks.com ↗
Confirmed: four-stage memory-resident infection chain; 17 modules; Chrome CDP hijacker and Telegram trojanizer; polymorphic loader recompiled hourly; 40 C2 domains and 7 IPs as IOCs. No CVEs cited.
why Primary source establishes all key technical facts, confirms no CVE involvement, and provides actionable IOCs.
- Does Microsoft have a prior advisory independently corroborating XCSSET's Xcode distribution mechanism?Searched for 'XCSSET Microsoft advisory 2025 September Xcode projects CVE'.
Microsoft Security Blog published a dedicated XCSSET analysis on 25 September 2025 covering a prior variant's obfuscation, persistence, and browser-targeting evolution.
why Confirms an independent institutional source corroborates the supply-chain distribution claim, strengthening overall confidence.
- What does the Microsoft September 2025 blog specifically state, and does it cite any CVEs?Fetched the Microsoft Security Blog XCSSET September 2025 article.microsoft.com ↗
Microsoft confirmed the Xcode project distribution vector, clipboard hijacking, Firefox data exfiltration module, and LaunchDaemon persistence in a prior variant. No CVEs cited.
why Independent institutional corroboration from a separate organisation with its own research capability; raises confidence in the distribution mechanism assessment.
- Does CybersecurityNews independently confirm the Chrome DevTools Protocol fileless reverse-shell technique?Fetched the CybersecurityNews article on XCSSET v40 CDP abuse.cybersecuritynews.com ↗
Independently confirmed CDP abuse for JavaScript injection, fileless reverse-shell via Chrome process, and two attack waves. No CVEs.
why A third independent outlet corroborating the most novel technical claim (CDP-based fileless reverse shell) increases confidence in that specific finding.
- Does GBHackers add any detail on attribution, geographic scope, or OPSEC failures not present in Unit 42?Fetched the GBHackers XCSSET v40 article.gbhackers.com ↗
Added: South Asia geographic targeting, operator OPSEC failures (reused SSL certificates and SSH keys enabling campaign correlation), and Google's planned macOS CDP protections. No CVEs.
why Provides additional operational context on targeting scope and infrastructure fingerprinting that informs defensive actions and uncertainty assessment.
Research coverage
All 68 registered source leaves were evaluated for this run: 56 completed, 0 were unavailable, 5 failed and 7 were disabled. For this story, 2 registered sources supplied useful evidence (2 primary, 0 corroborating, 0 contextual and 0 PoC/exploit references). 54 completed sources contained no matched information for this story.
Complete source-by-source audit 68 sources
| Source | Run result | Value | Why it was useful — or not |
|---|---|---|---|
| BleepingComputernews | ok7 records | Primary evidence1 matched items | Published the source report used to frame and date the event. |
| Microsoft Securitynews | ok3 records | Primary evidence1 matched items | Supplied a vendor or government advisory opened and verified during focused research. |
| AlienVault OTXdark_web | ok10 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| CIRCL CVEcve | ok30 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| CISA Alertsnews | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| CISA KEVkev | ok1660 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Cisco PSIRTvendor_advisory | ok5309 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Cisco Talosnews | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI CVE most exploiteddeepdarkcti | ok94 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI Discorddeepdarkcti | ok7 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI exploitsdeepdarkcti | ok24 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI forumsdeepdarkcti | ok260 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI malware as a servicedeepdarkcti | ok7 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI malware samplesdeepdarkcti | ok3 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI marketsdeepdarkcti | ok127 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI phishingdeepdarkcti | ok19 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI ransomware gangsdeepdarkcti | ok670 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI RATsdeepdarkcti | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI Telegram infostealerdeepdarkcti | ok130 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI Telegram threat actorsdeepdarkcti | ok1007 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI Twitter threat actorsdeepdarkcti | ok39 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| DNSDumpster domain IOC enrichmentresearch | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Exploit-DBexploit_reference | failed | Failed | The current collection attempt failed; this source cannot support the report. |
| FIRST EPSSepss | ok7475 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Fortinet PSIRTvendor_advisory | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| GitHub topic: cveresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GitHub topic: exploitresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GitHub topic: penetration-testingresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GitHub topic: pocresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GitHub topic: vulnerabilityresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GreyNoiseexploit_reference | failed | Failed | The current collection attempt failed; this source cannot support the report. |
| KrebsOnSecuritynews | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| LinkedIn RSS proxy feeds (disabled)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| MalwareBazaardark_web | ok10 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #cveresearch | ok20 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #cybersecurityresearch | ok19 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #exploitresearch | ok14 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #infosecresearch | ok20 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #malwareresearch | ok19 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #ransomwareresearch | ok20 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #threatintelresearch | ok15 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #vulnerabilityresearch | ok20 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Metasploit module metadataexploit_reference | failed | Failed | The current collection attempt failed; this source cannot support the report. |
| Microsoft MSRCvendor_advisory | ok1588 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| MISP Galaxyresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| MISP threat actor galaxyactor | ok0 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| NVDcve | ok900 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Palo Alto Networks PSIRTvendor_advisory | ok25 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| ProjectDiscovery nuclei templatesexploit_reference | failed | Failed | The current collection attempt failed; this source cannot support the report. |
| Rapid7news | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Reddit r/AskNetsec (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| Reddit r/cybersecurity (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| Reddit r/malware (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| Reddit r/netsec (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| Reddit r/ReverseEngineering (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| SANS ISCnews | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Shadowserver public aggregate honeypot observationsexploit_reference | failed | Failed | The current collection attempt failed; this source cannot support the report. |
| Shodanresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Sigma Rulesresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Sophos IOCsresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| The Hacker Newsnews | ok8 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| ThreatFoxthreat_intelligence | ok100 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| UK NCSCnews | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Unit42 IOCsresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| URLhausdark_web | ok10 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| VirusTotal Community IOC enrichmentresearch | ok3 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| VulnCheck KEVkev | ok500 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Vulnerability Lookupcve | ok30 records | Checked — no match | The source completed, but none of its retained records matched this story. |
Additional verified pages 3 opened outside the registered collection
Vendor & gov advisories1
Microsoft Threat Intelligence documented a prior XCSSET variant in September 2025, establishing the Xcode project distribution mechanism and browser-targeting evolution as an independent institutional corroborator.
Analysis & research3
Primary technical analysis by Unit 42; covers the four-stage infection chain, 17 modules, Chrome CDP hijacker, Telegram trojanizer, polymorphic loader, and 40 C2 domains.
Independent reporting corroborating the Chrome DevTools Protocol fileless reverse-shell technique and two-wave attack timeline.
Adds detail on operator OPSEC failures (reused SSL certificates and SSH keys), South Asia geographic targeting, and Google's planned macOS CDP protections.