Full Report
A new version of the XCSSET malware is targeting thousands of macOS users through compromised Xcode projects and GitHub repositories. [...]
Analysis Summary
# Tool/Technique: XCSSET (Version 40)
## Overview
XCSSET is a sophisticated macOS-specific malware family that primarily targets software developers by infecting Xcode projects. Once a compromised project is built, the malware infects the local system and attempts to spread further by injecting malicious scripts into other Xcode projects found on the host. The latest version (v40) introduces enhanced evasion techniques and specialized modules for browser hijacking and messaging application compromise.
## Technical Details
- **Type:** Malware Family (Trojan / Downloader / Infostealer)
- **Platform:** macOS
- **Capabilities:** Credential theft, keystroke logging, clipboard manipulation, browser hijacking (Chrome), Telegram trojanization, and data exfiltration.
- **First Seen:** Approximately 2021 (Version 40 observed mid-April to early May 2026)
## MITRE ATT&CK Mapping
- **[TA0001 - Initial Access]**
- [T1195.001 - Supply Chain Compromise: Compromise Software Dependencies and Development Tools]
- **[TA0002 - Execution]**
- [T1059.002 - Command and Scripting Interpreter: AppleScript]
- [T1204.002 - User Execution: Malicious File]
- **[TA0005 - Defense Evasion]**
- [T1562.001 - Impair Defenses: Disable or Modify Tools] (Disabling XProtect, MRT, TCC)
- [T1027 - Obfuscated Files or Information]
- [T1406 - Obfuscation: Software Packing/Compiling]
- **[TA0006 - Credential Access]**
- [T1555.003 - Credentials from Web Browsers]
- [T1539 - Steal Web Session Cookie]
- **[TA0009 - Collection]**
- [T1056.001 - Input Capture: Keylogging]
- [T1115 - Clipboard Data]
## Functionality
### Core Capabilities
- **Project Infection:** Injecting downloader scripts into benign files within Xcode projects to ensure persistence and propagation.
- **System Command Execution:** Utilizing a fileless reverse shell for remote control.
- **Security Impairment:** Disabling macOS-specific security features including XProtect, MRT, TCC, and Rapid Security Response.
- **Data Theft:** Stealing credentials, browser cookies, and MetaMask transaction data.
### Advanced Features
- **Chrome Hijacker:** Wraps the browser in a malicious launcher and uses the Chrome DevTools Protocol (CDP) to inject remote JavaScript into web sessions.
- **Telegram Trojanizer:** Deletes the legitimate Telegram Desktop application and replaces it with a malicious version to intercept communications.
- **Sophisticated Evasion:** Periodically re-compiling loaders on the C2 server, using unique encryption keys for inbound/outbound traffic, and obfuscating function names with build-unique ciphers.
## Indicators of Compromise
*Note: Specific hashes were not provided in the source text, but the following indicators were identified:*
- **File Names:** Malicious launcher wrappers for Chrome and Telegram.
- **Network Indicators:**
- C2 infrastructure (specific domains: `[defanged_C2_address]`)
- Local port communication for Chrome DevTools Protocol.
- **Behavioral Indicators:**
- Anomalous AppleScript activity.
- Termination of `CloudTelemetryService`.
- Modification of `macOS defaults` domains.
- Presence of ad hoc-signed applications bypassing Gatekeeper.
## Associated Threat Actors
- Unknown (Tracked by various firms focusing on macOS-centric campaigns targeting development environments).
## Detection Methods
- **Signature-based:** Updating EDR/AV definitions to flag known XCSSET loader patterns and unique encryption ciphers.
- **Behavioral:** Monitoring for unauthorized modifications to browser binaries and the disabling of system security services (XProtect/MRT).
- **Pipeline Security:** Implementing automated scanning of open-source dependencies and Git repositories for unauthorized script injections.
## Mitigation Strategies
- **Pipeline Integrity:** Verify the integrity of Xcode projects downloaded from GitHub or other public repositories before building.
- **System Hardening:** Ensure macOS Gatekeeper is enforced and monitor for "ad hoc" signed applications.
- **Access Control:** Regularly audit TCC (Transparency, Consent, and Control) permissions to ensure apps do not have unnecessary access to system resources.
## Related Tools/Techniques
- **Supply Chain Attacks:** Similar to attacks targeting NPM or PyPI, but specifically focused on the Apple development ecosystem.
- **Browser Hijacking:** Utilizing CDP is a technique seen in other advanced infostealers to bypass traditional browser security boundaries.