The operators behind the XCSSET malware have released version 40, a major upgrade that hides its core logic in memory, reduces its digital footprint, and spreads through trojanized Xcode projects in supply chain attacks against macOS developers.
Palo Alto Networks Unit 42 says the malware has ridden inside the Xcode projects of dozens of legitimate apps with thousands of active users since early April 2026. Xcode serves as Apple’s toolset for developing applications. The refreshed variant can also touch every Xcode project already on an infected machine, sharpening its worm-like spread.
The infection chain runs through four stages before final payload execution: an initial loader establishes command-and-control communication, a second stage fingerprints the system and downloads more modules, a temporary staging applet loads the final stage into volatile memory, and the core module logic then terminates staging processes and deletes all installation files from disk.
Unit 42 uncovered 17 distinct modules, including two new components: a Chrome hijacking backdoor that abuses the legitimate Chrome DevTools Protocol, and a Telegram trojanizer. The Chrome module wraps the benign Google Chrome binary in a malicious persistence script, launches the browser with CDP activated on a local port, and drops a binary that connects to the port, letting attackers execute arbitrary JavaScript, manipulate active sessions, and extract cookies invisibly. It can intercept traffic, alter cryptocurrency wallet addresses, capture password-manager autofill fields, and even execute local system commands through a stealthy fileless reverse shell.
The malware combines polymorphic payload generation with fileless persistence and dynamic in-memory execution, using a multi-layered cipher shift to conceal its functions. Unit 42 reported the browser behavior to Google, which is expanding protections to macOS.
