XCSSET is a long-running macOS malware family first documented by Trend Micro in August 2020, notable for infecting Xcode projects to create supply-chain risks for macOS developers. The malware injects malicious build-phase scripts into .xcodeproj files so that compiling the project triggers execution. Version 40 (v40), analyzed by Palo Alto Networks Unit 42 after a dormant period, represents a significant escalation in capability and stealth.

The infection chain operates in four stages. Stage 1: an attacker compromises Git repositories and injects a downloader script into the Xcode project build phases of legitimate .xcodeproj files; when a developer builds the project locally, a run-script phase executes silently, contacting the C2 via curl to /a with parameter p=xcode_phase. Stage 2: the staging payload performs reconnaissance — querying uname -s (OS type) and whoami (username) — exfiltrating host metadata to the C2. Stage 3: the C2 returns a Bash script obfuscated via a custom substitution cipher, performing hardware fingerprinting against targeted serial profiles, then pulling the primary loader to /tmp/r and compiling an AppleScript wrapper as /tmp/p.app; the loader executes in-memory via osascript. Stage 4: the main orchestrator (named 'boot') runs entirely in memory, retrieving additional modules from the C2 via HTTPS, piping payloads to AppleScript for in-memory decryption and execution, then terminating all staging processes and deleting installation files from disk.

XCSSET v40 delivers 17 modular components, each with a distinct function. The orchestrator 'boot' dispatches modules including stats (reconnaissance, anti-VM, browser extension exfiltration), clipboard_v2 (keyboard hijacker), payloader (secondary dispatcher), replicator_finder (Xcode project file infector), git_finder (Git pre-commit hook infector), zip_infect_finder (NEW — traverses directories to find/infect Xcode projects inside .zip archives), data_folders_finder (C2-driven folder finder and exfiltrator), firefox_data (Firefox infostealer), notes_app (Apple Notes exfiltrator), settings_app (LaunchDaemon persistence via fake Settings.app; blocks XProtect), finder_app (TCC permission abuse; creates trojanized apps mimicking Finder/Xcode/Terminal/Reminders/SimulatorTrampoline), persist (.zshrc and Dock-based persistence), browser_remote (unified browser hijack dispatcher), safari_remote (Safari hijacker), chrome_remote (NEW — Chrome CDP backdoor), and tdesktop (NEW — Telegram Desktop trojanizer).

The two new modules in v40 are the most significant additions. The Chrome hijacker (chrome_remote) wraps the legitimate Google Chrome binary in a malicious launcher: when Chrome launches, the malware restarts the boot orchestrator, activates Chrome DevTools Protocol (CDP) on localhost:18907, and drops a helper binary that connects to CDP. This helper establishes a persistent WebSocket connection to the C2, injects JavaScript before pages load, hooks window.fetch and XMLHttpRequest to exfiltrate credentials and API tokens, intercepts MetaMask's Ethereum provider to manipulate cryptocurrency transactions, and overrides password-manager autofill fields. It also monitors browser console events; when the operator sends a console.log with a specific delimiter prefix, chrome_remote executes the payload via exec.Command on the host, creating a fileless reverse shell routed through the CDP WebSocket. Google has protections against CDP abuse on Windows and is extending defenses to macOS.

The Telegram Desktop trojanizer (tdesktop), which appeared in the May 2026 wave but not the April deployment, downloads a pre-built malicious Telegram.app ZIP from the C2, deletes the legitimate copy, drops the replacement, ad hoc code-signs it, and kills the original Telegram process so the victim relaunches the trojanized copy. Its configuration is AES-encrypted and stored in ~/.tr.

XCSSET v40 employs aggressive evasion. The loader binary is recompiled on the C2 every few hours — Unit 42 observed 8 distinct hashes delivered to one endpoint in 24 hours. A dual-key encryption architecture uses separate AES-256-CBC keys for inbound versus outbound C2 traffic; the inbound key embedded in the compiled AppleScript loader means network telemetry alone cannot decrypt core logic. String literals use per-module keyed Caesar ciphers with randomized 52-character alphabets and variable shift values, ensuring no two builds share common string signatures. Function, module, and variable names are scrambled server-side via a substitution cipher before distribution, with the decryption mapping absent from the endpoint.

The malware aggressively disables macOS security: it blocks XProtect signature updates, disables MRT (Malware Removal Tool) updates, resets the TCC database, blocks Rapid Security Response delivery, and runs a constant loop terminating Apple's CloudTelemetryService. It spawns a Perl process to acquire and hold an exclusive file lock on the YARA-rule database (XPdb), preventing security update writes. When the user denies AppleEvents automation, it invokes tccutil reset AppleEvents and re-prompts with a dialog masquerading as System Settings or Xcode. The stats module performs anti-VM checks via CPU and hardware metadata and withholds module delivery from identified virtual machines.

C2 infrastructure includes approximately 64 domains registered in four short bursts during early 2026 from a small IP pool, aged for months before activation to bypass new-domain detection. Domains shifted from .ru TLDs in 2025 campaigns to .in TLDs in 2026, consistent with South Asian targeting. Operator OPSEC failures include cross-contaminated IP addresses across different XCSSET campaigns, a shared SSL certificate thumbprint (6e480d648fa1b70612f5d198a66875e28847547d) across all four operator IPs, and reused SSH keys and a self-signed RDP certificate.

Attribution remains unclear; no named APT group or nation-state has been assigned. Geographic targeting concentrates on South Asia, consistent with Trend Micro's 2020 reporting. The primary motivation appears financial given the cryptocurrency address manipulation, credential theft, and session hijacking, though the malware's data exfiltration capabilities could serve espionage objectives. The supply-chain vector targeting macOS developers through GitHub compromises gives the malware exceptional reach, with infected Xcode projects belonging to dozens of legitimate applications with thousands of active users.