XCSSET v40 Spreads Through Compromised Xcode Projects, Adds Chrome and Telegram Modules

Aug 4, 2026 · Original article ↗

Summary

Unit 42 reports that XCSSET v40 infects developers who build compromised Xcode projects, then spreads through shared source code. New modules hijack Chrome and replace Telegram Desktop, while the malware adds evasion tactics and attempts to disable macOS protections.

Key points

The malware is distributed through compromised Git repositories that inject a downloader into Xcode project files; developers are infected when they build the projects.
XCSSET can propagate to other Xcode projects on an infected system and spread through shared source code.
Unit 42 observed 17 modules for activities including credential theft, keylogging, clipboard manipulation, browser hijacking, and data exfiltration.
A new Chrome module enables the Chrome DevTools Protocol on a local port to retrieve JavaScript from attacker infrastructure, enabling web traffic interception and a fileless reverse shell.
A new Telegram trojanizer replaces Telegram Desktop with a malicious version; Unit 42 could not decrypt its configuration, so its exact functionality is unknown.
Evasion measures include re-compiling the loader on the command-and-control server, separate encryption keys for inbound and outbound communications, and obfuscated code.
XCSSET attempts to disable XProtect, MRT, TCC, and Rapid Security Response; Unit 42 recommends monitoring for anomalous AppleScript activity and unauthorized browser modifications.

Article Details

Attack Vectors: XCSSET v40 is distributed through compromised Git repositories and Xcode projects containing a downloader script; developers are infected when they build the poisoned projects, which then propagate through other Xcode projects and shared source code.
A Chrome hijacker wraps the browser in a malicious launcher, enables the Chrome DevTools Protocol on a local port, and fetches JavaScript from attacker C2 infrastructure to intercept web traffic and enable system command execution through a fileless reverse shell.
A Telegram trojanizer replaces the legitimate Telegram Desktop application with a malicious version; its exact functionality is unknown because Unit 42 could not retrieve its encrypted configuration.
The malware uses separate encryption keys for inbound and outbound communications, periodically recompiles its loader on the C2 server, and obfuscates function names, variables, and strings with build-unique ciphers.
Defensive Notes: Monitor for anomalous AppleScript activity, unauthorized browser modifications, suspicious macOS defaults domains, and ad hoc-signed applications that bypass Gatekeeper.
Scan open-source dependencies to reduce the risk of compromised repositories entering software development pipelines.
Monitor and protect macOS security mechanisms, including XProtect, MRT, TCC, and Rapid Security Response; the article reports that XCSSET attempts to disable them and prevent XProtect signature updates.