XCSSET v40 Targets macOS Developers Through Compromised Xcode Projects

Building the Project Triggers the Infection

Palo Alto Networks Unit 42 has analyzed a new variant of XCSSET, dubbed v40, which targets macOS developers through compromised Xcode projects and GitHub repositories.

The attack is triggered when a victim builds a tampered project. The malware modifies seemingly legitimate files and uses shared source code to spread to other projects on the system.

The variant was observed in two waves: one in mid-April and another in early May. XCSSET has targeted the macOS ecosystem since at least 2021.

The infection chain unfolds in four stages and deploys 17 modules, combining persistence, data collection, evasion, and automated propagation across Xcode projects.

New Chrome and Telegram Modules

Unit 42 identified two components that had not previously been documented in the campaign.

The Chrome hijacker enables the Chrome DevTools Protocol and can intercept traffic, credentials, and cookies. It also targets MetaMask transactions and includes a fileless reverse shell, allowing commands to be executed without necessarily creating files on disk.

The Telegram trojanizer replaces Telegram Desktop with a malicious version. Analysts have not determined which specific functionality is activated after the replacement.

XCSSET also retains previously known capabilities, including keylogging, credential theft, clipboard manipulation, browser hijacking, and data exfiltration.

macOS Defenses and Evasion Techniques Under Attack

The variant attempts to disable or tamper with several macOS security mechanisms, including XProtect, MRT, TCC, and Rapid Security Response. It can also terminate CloudTelemetryService and prevent XProtect signatures from being updated.

To hinder analysis, the loader is periodically recompiled. Builds use different keys to communicate with the command-and-control infrastructure and rely on unique ciphers for obfuscation.

The primary risk involves the software supply chain: a single compromised project can infect other repositories, contaminate development pipelines, and introduce malicious code into products built by an organization.

Recommended Controls for Teams and Developers

Organizations should verify the origin and integrity of Xcode projects before building them and scan repositories and open-source dependencies before incorporating them into CI/CD pipelines.

Additional monitoring should cover:

• anomalous AppleScript activity;
• unauthorized browser modifications;
• suspicious defaults domains;
• ad hoc-signed applications that bypass Gatekeeper;
• unexpected crashes of Apple services;
• attempts to modify XProtect, MRT, TCC, or Rapid Security Response;
• unexpected use of the Chrome DevTools Protocol;
• traffic to command-and-control infrastructure.

Following a suspected compromise, credentials and tokens should be rotated, with particular attention to browser accounts, Telegram, and MetaMask wallets.