The operators behind the XCSSET malware have released version 40, a major upgrade that hides its core logic in memory, reduces its digital footprint, and spreads through trojanized Xcode projects in supply chain attacks against macOS developers.
Since early April 2026, the malware has been distributed through Xcode projects of dozens of legitimate applications with thousands of active users, according to Palo Alto Networks Unit 42. Xcode is Apple’s integrated development environment for building apps. The new version can infect all existing Xcode projects on a compromised system, upgrading its worming capabilities.
The infection chain runs through four stages before final payload execution: an initial loader establishes command-and-control communication, a second stage fingerprints the system and downloads more modules, a temporary staging applet loads the final stage into volatile memory, and the core module logic then terminates staging processes and deletes all installation files from disk.
Unit 42 uncovered 17 distinct modules, including two new components: a Chrome hijacking backdoor that abuses the legitimate Chrome DevTools Protocol, and a Telegram trojanizer. The Chrome module wraps the benign Google Chrome binary in a malicious persistence script, launches the browser with CDP activated on a local port, and drops a binary that connects to the port, letting attackers execute arbitrary JavaScript, manipulate active sessions, and extract cookies invisibly. It can intercept traffic, alter cryptocurrency wallet addresses, capture password-manager autofill fields, and even execute local system commands through a stealthy fileless reverse shell.
The malware combines polymorphic payload generation with fileless persistence and dynamic in-memory execution, using a multi-layered cipher shift to conceal its functions. Unit 42 reported the browser behavior to Google, which is expanding protections to macOS.
