Malware

chrome_remote

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

10 distinct techniques documented for this family, organized by ATT&CK tactic.

Execution

2 techniques

T1059Command and Scripting InterpreterEvidence2

Operators send a specially marked console event, chrome_remote extracts the command, passes it to the macOS shell, then returns output through the CDP WebSocket connection.

T1574Hijack Execution FlowEvidence1

The malware wraps the real Chrome application in a malicious launcher. Each time Chrome opens, the launcher restarts XCSSET, enables CDP on a local port, and runs a helper binary called chrome_remote.

Stealth

1 technique

T1574Hijack Execution FlowEvidence1

Credential Access

3 techniques

T1056.003Web Portal CaptureEvidence1

It can collect cookie tokens, watch web-request traffic, capture password-manager autofill data...

T1539Steal Web Session CookieEvidence3

chrome_remote : Backdoor via le protocole Chrome DevTools (CDP), WebSocket persistant vers le C2, injection JavaScript, vol de cookies/credentials

T1555Credentials from Password StoresEvidence1

Credential theft: Overriding password-manager autofill fields captures credentials

Collection

2 techniques

T1056.003Web Portal CaptureEvidence1

It can collect cookie tokens, watch web-request traffic, capture password-manager autofill data...

T1185Browser Session HijackingEvidence1

This binary connects to the opened CDP port, allowing the attackers to execute arbitrary JavaScript, manipulate active browser sessions and extract cookie tokens invisibly.

Command and Control

3 techniques

T1071.001Web ProtocolsEvidence3

Phase 1 : Script initial injecté dans le projet Xcode, contact C2 via /a

T1105Ingress Tool TransferEvidence1

The second stage collects basic fingerprinting information on the system and downloads further modules.

T1219Remote Access ToolsEvidence1

The resulting shell output is then packaged and routed back through the active CDP WebSocket to the C2 server, establishing a stealthy, fileless reverse shell.

Exfiltration

1 technique

T1041Exfiltration Over C2 ChannelEvidence1

Hooks placed on window.fetch and XMLHttpRequest monitor to exfiltrate sensitive data streams, credentials and API tokens

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

cyberveilleNews

Aug 2, 2026

XCSSET v40 : nouvelle version du malware macOS avec architecture furtive et modules avancés | CyberVeille

A specialized XCSSET module that acts as a backdoor through the Chrome DevTools Protocol, enabling persistent C2 communications, JavaScript injection, cookie and credential theft, crypto-wallet manipulation, and a fileless reverse shell.

palo alto networks unit 42 blogNews

Jul 31, 2026

The Xcode Assassin Returns: A Deep Dive Into the Latest XCSSET Version

A new XCSSET v40 module/binary that abuses Chrome DevTools Protocol to hijack Chrome sessions, inject JavaScript into pages, intercept traffic and credentials, manipulate crypto-wallet interactions, steal cookies, and execute host shell commands via a stealthy fileless reverse shell.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping10

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

Malware

chrome_remote

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

10 distinct techniques documented for this family, organized by ATT&CK tactic.

Execution

2 techniques

T1059Command and Scripting InterpreterEvidence2

Operators send a specially marked console event, chrome_remote extracts the command, passes it to the macOS shell, then returns output through the CDP WebSocket connection.

T1574Hijack Execution FlowEvidence1

Stealth

1 technique

T1574Hijack Execution FlowEvidence1

Credential Access

3 techniques

T1056.003Web Portal CaptureEvidence1

It can collect cookie tokens, watch web-request traffic, capture password-manager autofill data...

T1539Steal Web Session CookieEvidence3

chrome_remote : Backdoor via le protocole Chrome DevTools (CDP), WebSocket persistant vers le C2, injection JavaScript, vol de cookies/credentials

T1555Credentials from Password StoresEvidence1

Credential theft: Overriding password-manager autofill fields captures credentials

Collection

2 techniques

T1056.003Web Portal CaptureEvidence1

It can collect cookie tokens, watch web-request traffic, capture password-manager autofill data...

T1185Browser Session HijackingEvidence1

This binary connects to the opened CDP port, allowing the attackers to execute arbitrary JavaScript, manipulate active browser sessions and extract cookie tokens invisibly.

Command and Control

3 techniques

T1071.001Web ProtocolsEvidence3

Phase 1 : Script initial injecté dans le projet Xcode, contact C2 via /a

T1105Ingress Tool TransferEvidence1

The second stage collects basic fingerprinting information on the system and downloads further modules.

T1219Remote Access ToolsEvidence1

The resulting shell output is then packaged and routed back through the active CDP WebSocket to the C2 server, establishing a stealthy, fileless reverse shell.

Exfiltration

1 technique

T1041Exfiltration Over C2 ChannelEvidence1

Hooks placed on window.fetch and XMLHttpRequest monitor to exfiltrate sensitive data streams, credentials and API tokens

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

cyberveilleNews

Aug 2, 2026

XCSSET v40 : nouvelle version du malware macOS avec architecture furtive et modules avancés | CyberVeille

palo alto networks unit 42 blogNews

Jul 31, 2026

The Xcode Assassin Returns: A Deep Dive Into the Latest XCSSET Version

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping10

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.