cyber.hendryadrian.com
Threat Research · unit42.paloaltonetworks.com

XCSSET v40 Uses Memory-Resident Execution to Hijack macOS Browsers and Trojanize Telegram

· Original article ↗

Summary

Unit 42 details XCSSET v40, macOS malware spread through poisoned Xcode projects, with memory-resident payloads, Chrome CDP hijacking, a Telegram trojanizer, and techniques to impair Apple security mechanisms.

Key points

  • Unit 42 traced infection to malicious scripts in Xcode projects or Git repositories; execution begins when a developer builds the project, followed by host fingerprinting and staged, memory-resident payloads.
  • The Chrome module enables the Chrome DevTools Protocol (CDP) and injects remote JavaScript to capture credentials, cookie tokens, and API data; it can also relay shell commands and output through a WebSocket C2 connection.
  • A module identified in May 2026 replaces Telegram Desktop with a malicious ad hoc-signed app. Unit 42 could not verify the exact contents of its encrypted configuration.
  • XCSSET v40 uses polymorphic loaders and encrypted modules; researchers observed eight distinct loader hashes delivered to one endpoint within 24 hours.
  • Persistence methods include Git hooks, Launch Daemons, trojanized applications, and macOS defaults. The malware also targets updates, telemetry, XProtect files, and TCC permissions.
  • The stats module checks for virtual environments, and hosts identified as virtual receive no further module deliveries, according to Unit 42.
  • Unit 42 recommends behavioral monitoring, checking browser launch paths and macOS defaults changes, identifying ad hoc-signed apps, and scanning developer supply chains for poisoned projects.

Article Details

Attack Vectors
  • XCSSET is delivered through poisoned Xcode projects and vulnerable Git repositories; the infection runs when a developer builds the project locally.
  • The malware uses staged loaders that contact C2 infrastructure, collect host information, download modules, and execute core logic in memory.
  • A malicious wrapper around Google Chrome launches the browser with Chrome DevTools Protocol enabled and uses a backdoor to inject JavaScript, manipulate sessions, and run shell commands.
  • A Telegram Desktop trojanizer downloads a malicious replacement app, removes the legitimate copy, and launches the replacement.
  • Persistence and re-infection mechanisms include Git hooks, Launch Daemons, .zshrc modification, trojanized applications, and payloads stored in macOS defaults.
Defensive Notes
  • Monitor abnormal AppleScript activity and process chains, including suspicious osascript calls and processes spawned from infected Xcode project build phases.
  • Monitor browser launcher paths and block unauthorized file writes.
  • Detect abnormal macOS defaults domains and changes made through the defaults utility.
  • Track ad hoc signed applications and untrusted local code signers; isolate binaries that bypass native Gatekeeper requirements.
  • Use automated supply-chain dependency scanning to detect poisoned open-source repositories before they enter developer pipelines.

Indicators of compromise

TypeIndicatorContext
DOMAINamzndev[.]inListed as an XCSSET v40 C2 domain and used to serve the Chrome CDP helper binary.
DOMAINamzndev[.]ruListed as an XCSSET v40 C2 domain and used to serve the Chrome CDP helper binary.
DOMAINapplecdn[.]ruListed in the article’s XCSSET v40 C2 domain infrastructure.
DOMAINapplehosts[.]ruListed in the article’s XCSSET v40 C2 domain infrastructure.
DOMAINcdnamz[.]inListed in the article’s XCSSET v40 C2 domain infrastructure.
DOMAINcdnamz[.]ruListed in the article’s XCSSET v40 C2 domain infrastructure.
DOMAINdnsapple[.]ruListed in the article’s XCSSET v40 C2 domain infrastructure.
DOMAINgooglenets[.]ruListed as an XCSSET v40 C2 domain and used to serve the Chrome CDP helper binary.
DOMAINicloudsnet[.]ruListed in the article’s XCSSET v40 C2 domain infrastructure.
DOMAINnetcdnamz[.]ruListed in the article’s XCSSET v40 C2 domain infrastructure.
DOMAINnetcdndev[.]inListed as an XCSSET v40 C2 domain and used to serve the Chrome CDP helper binary.
DOMAINrigmanets[.]inListed in the article’s XCSSET v40 C2 domain infrastructure.
DOMAINtimewebnet[.]inListed in the article’s XCSSET v40 C2 domain infrastructure.
DOMAINwhitead[.]inListed as an XCSSET v40 C2 domain and used to serve the Chrome CDP helper binary.
DOMAINwhiteads[.]ruListed as an XCSSET v40 C2 domain and used to serve the Chrome CDP helper binary.
DOMAINwincdn[.]ruListed in the article’s XCSSET v40 C2 domain infrastructure.
IPV4151[.]243[.]109[.]188Listed as XCSSET v40 C2 infrastructure.
IPV4178[.]208[.]92[.]129Listed as XCSSET v40 C2 infrastructure.
IPV4178[.]208[.]92[.]168Listed as XCSSET v40 C2 infrastructure.
IPV491[.]108[.]106[.]229Listed as XCSSET v40 C2 infrastructure.
IPV495[.]142[.]35[.]206Listed as XCSSET v40 C2 infrastructure.
IPV495[.]142[.]35[.]34Listed as XCSSET v40 C2 infrastructure.
IPV495[.]142[.]37[.]159Listed as XCSSET v40 C2 infrastructure.
SHA16e480d648fa1b70612f5d198a66875e28847547dShared operator SSL certificate thumbprint associated with the XCSSET campaign infrastructure.
URLhxxps[:]//amzndev[.]in/d/zw_sfp64C2 URL identified as a download location for the Chrome CDP helper binary.
URLhxxps[:]//amzndev[.]ru/d/zw_sfp64C2 URL identified as a download location for the Chrome CDP helper binary.
URLhxxps[:]//googlenets[.]ru/d/zw_sfp64C2 URL identified as a download location for the Chrome CDP helper binary.
URLhxxps[:]//netcdndev[.]in/d/zw_sfp64C2 URL identified as a download location for the Chrome CDP helper binary.
URLhxxps[:]//whitead[.]in/d/zw_sfp64C2 URL identified as a download location for the Chrome CDP helper binary.
URLhxxps[:]//whiteads[.]ru/d/zw_sfp64C2 URL identified as a download location for the Chrome CDP helper binary.

MITRE ATT&CK

T1027 · Obfuscated Files or InformationThe malware uses layered encryption, randomized payloads, and ciphers to obscure binaries, strings, and source code.T1041 · Exfiltration Over C2 ChannelXCSSET sends collected host data, files, browser data, and command output back through its C2 infrastructure.T1056.001 · KeyloggingThe article describes keyboard-hijacking functionality in XCSSET modules.T1059.002 · AppleScriptThe malware uses AppleScript loaders and executes modules through AppleScript.T1059.004 · Unix ShellA downloaded bash script stages the loader, and the Chrome backdoor can pass commands to the host shell.T1071.001 · Web ProtocolsThe malware uses HTTP requests and a persistent WebSocket connection for C2 communication.T1082 · System Information DiscoveryThe stats module checks operating-system and hardware metadata, including VM-related hardware information.T1105 · Ingress Tool TransferXCSSET downloads loaders, modules, and payloads from its C2 infrastructure.T1195.001 · Compromise Software Dependencies and Development ToolsXCSSET spreads through poisoned Xcode projects and infected open-source repositories.T1204.002 · Malicious FileThe infection is triggered when a developer builds the poisoned Xcode project locally.T1497.001 · System ChecksThe stats module checks CPU and hardware metadata to determine whether the infected endpoint is a virtual machine.T1543.004 · Launch DaemonThe article reports persistence through Launch Daemons.T1546.004 · Unix Shell Configuration ModificationXCSSET uses .zshrc-based persistence and re-infection.T1555.003 · Credentials from Web BrowsersThe Chrome backdoor captures password-manager autofill credentials and browser cookie tokens.T1562.001 · Disable or Modify ToolsXCSSET hinders security updates and telemetry, locks the XProtect signature database, and resets TCC permissions.

Malware

XCSSETXCSSET v40 is a heavily updated macOS malware family that uses memory-resident execution, polymorphism, and supply-chain infection through poisoned Xcode projects to target developers.

Vendors

Apple#XCSSETGoogleIt does this by wrapping the benign Google Chrome binary in a malicious persistence script.Palo Alto NetworksPalo Alto Networks customers are better protected from the threats discussed above through the following products and services:

Products

Cortex XDRFigure 6 illustrates the encrypted payload injection process into osascript as detected in Cortex XDR.Cortex XSIAMAt the Security Operations level, Cortex XSIAM correlates these host-level detections with developer repository, network, and identity telemetry, providing SOC analysts with a unified attack narrative and automatedGoogle ChromeIt does this by wrapping the benign Google Chrome binary in a malicious persistence script.macOSXCSSET v40 is a heavily updated macOS malware family that uses memory-resident execution, polymorphism, and supply-chain infection through poisoned Xcode projects to target developers.Telegram DesktopXCSSET v40 introduces new modules, including a Chrome hijacking backdoor using the Chrome DevTools Protocol and a Telegram Desktop trojanizer.XcodeXCSSET v40 is a heavily updated macOS malware family that uses memory-resident execution, polymorphism, and supply-chain infection through poisoned Xcode projects to target developers.

Related Articles