XCSSET v40 macOS Malware Targeting Developers via Compromised Xcode Projects — Threadlinqs Intelligence
As of 2026-08-04, XCSSET v40 macOS Malware Targeting Developers via Compromised Xcode Projects is a high-severity malware threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 28 indicators of compromise.
Threat ID: TL-2026-1870 · Severity: HIGH · Status: ACTIVE · Category: MALWARE
XCSSET v40, a new variant of the modular macOS malware family first discovered in 2020, has resurfaced with two attack waves (April and May 2026) targeting developers across South Asia through
XCSSET is a long-running macOS malware family first documented by Trend Micro in August 2020, notable for infecting Xcode projects to create supply-chain risks for macOS developers. The malware injects malicious build-phase scripts into .xcodeproj files so that compiling the project triggers execution. Version 40 (v40), analyzed by Palo Alto Networks Unit 42 after a dormant period, represents a significant escalation in capability and stealth.
The infection chain operates in four stages. Stage 1: an attacker compromises Git repositories and injects a downloader script into the Xcode project build phases of legitimate .xcodeproj files; when a developer builds the project locally, a run-script phase executes silently, contacting the C2 via curl to /a with parameter p=xcode_phase. Stage 2: the staging payload performs reconnaissance — querying uname -s (OS type) and whoami (username) — exfiltrating host metadata to the C2. Stage 3: the C2 returns a Bash script obfuscated via a custom substitution cipher, performing hardware fingerprinting against targeted serial profiles, then pulling the primary loader to /tmp/r and compiling an AppleScript wrapper as /tmp/p.app; the loader executes in-memory via osascript. Stage 4: the main orchestrator (named 'boot') runs entirely in memory, retrieving additional modules from the C2 via HTTPS, piping payloads to AppleScript for in-memory decryption and execution, then terminating all staging processes and deleting installation files from disk.
XCSSET v40 delivers 17 modular components, each with a distinct function. The orchestrator 'boot' dispatches modules including stats (reconnaissance, anti-VM, browser extension exfiltration), clipboard_v2 (keyboard hijacker), payloader (secondary dispatcher), replicator_finder (Xcode project file infector), git_finder (Git pre-commit hook infector), zip_infect_finder (NEW — traverses directories to find/infect Xcode projects inside .zip archives), data_folders_finder (C2-driven folder finder and exfiltrator), firefox_data (Firefox infostealer), notes_app (Apple Notes exfiltrator), settings_app (LaunchDaemon persistence via fake Settings.app; blocks XProtect), finder_app (TCC permission abuse; creates trojanized apps mimicking Finder/Xcode/Terminal/Reminders/SimulatorTrampoline), persist (.zshrc and Dock-based persistence), browser_remote (unified browser hijack dispatcher), safari_remote (Safari hijacker), chrome_remote (NEW — Chrome CDP backdoor), and tdesktop (NEW — Telegram Desktop trojanizer).
The two new modules in v40 are the most significant additions. The Chrome hijacker (chrome_remote) wraps the legitimate Google Chrome binary in a malicious launcher: when Chrome launches, the malware restarts the boot orchestrator, activates Chrome DevTools Protocol (CDP) on localhost:18907, and drops a helper binary that connects to CDP. This helper establishes a persistent WebSocket connection to the C2, injects JavaScript before pages load, hooks window.fetch and XMLHttpRequest to exfiltrate credentials and API tokens, intercepts MetaMask's Ethereum provider to manipulate cryptocurrency transactions, and overrides password-manager autofill fields. It also monitors browser console events; when the operator sends a console.log with a specific delimiter prefix, chrome_remote executes the payload via exec.Command on the host, creating a fileless reverse shell routed through the CDP WebSocket. Google has protections against CDP abuse on Windows and is extending defenses to macOS.
The Telegram Desktop trojanizer (tdesktop), which appeared in the May 2026 wave but not the April deployment, downloads a pre-built malicious Telegram.app ZIP from the C2, deletes the legitimate copy, drops the replacement, ad hoc code-signs it, and kills the original Telegram process so the victim relaunches the trojanized copy. Its configuration is AES-encrypted and stored in ~/.tr.
XCSSET v40 employs aggressive evasion. The loader binary is recompiled on the C2 every few hours —
Target sectors: technology, software-development, finance-crypto
Target regions: South Asia
Detections & IOCs
As of 2026-08-08, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 28 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
MALWARE, HIGH, threat intelligence, cybersecurity, T1195, T1059, T1204, T1543, T1547, T1554, T1574, T1055, T1027, T1140
