Malware

XCSSET v40

Tracked since Aug 3, 2026 · Updated 3 months ago

Trending this weekNot trendingOutside this week’s top 100

Mention activity · 30 daysNo mention activity in the last 30 days.

Vulns0Associated

Actors0Associated

ATT&CK22Techniques

IOCs77Tracked

Is this in your environment?See whether this family's indicators match your telemetry and which of your assets are exposed to the CVEs associated with it.

Check your exposure

MITRE ATT&CK

Techniques & procedures

22 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1195.001Compromise Software Dependencies and Development ToolsEvidence1

Le malware se propage via une attaque de chaîne d’approvisionnement en injectant un script downloader dans des projets Xcode légitimes hébergés sur GitHub.

Execution

2 techniques

T1059.002AppleScriptEvidence1

Phase 3 : Téléchargement du loader principal, compilation d’un wrapper AppleScript, exécution en mémoire via osascript

T1059.004Unix ShellEvidence1

T1059.004 — Command and Scripting Interpreter: Unix Shell (Execution)

Persistence

2 techniques

T1176Software ExtensionsEvidence1

T1176 — Browser Extensions (Persistence)

T1543.004Launch DaemonEvidence1

T1543.004 — Create or Modify System Process: Launch Daemon (Persistence)

Privilege Escalation

2 techniques

T1055Process InjectionEvidence1

T1055 — Process Injection (Defense Evasion)

T1543.004Launch DaemonEvidence1

T1543.004 — Create or Modify System Process: Launch Daemon (Persistence)

Stealth

6 techniques

T1027.002Software PackingEvidence1

Polymorphisme multi-couches : recompilation du loader toutes quelques heures (8 hashes distincts en 24h)

T1027.009Embedded PayloadsEvidence1

Persistance fileless : utilisation du système defaults macOS pour stocker des payloads Base64 encodés sous des clés aléatoires

T1036.005Match Legitimate Resource Name or LocationEvidence1

tdesktop : Trojaniseur Telegram Desktop — remplace le binaire légitime par une version malveillante signée ad hoc

T1055Process InjectionEvidence1

T1055 — Process Injection (Defense Evasion)

T1497.001System ChecksEvidence1

Anti-VM : module stats vérifiant CPU/hardware, résultats envoyés au C2 pour bloquer les sandboxes

T1620Reflective Code LoadingEvidence1

Phase 4 : Module orchestrateur boot en mémoire, chargement des modules spécialisés

Defense Impairment

2 techniques

T1553.002Code SigningEvidence1

tdesktop : Trojaniseur Telegram Desktop — remplace le binaire légitime par une version malveillante signée ad hoc

T1685Disable or Modify ToolsEvidence1

Affaiblissement des défenses : désactivation de SoftwareUpdate, blocage de CloudTelemetryService, verrou exclusif sur la base YARA XProtect (XPdb), reset TCC via tccutil reset AppleEvents

Credential Access

2 techniques

T1056.001KeyloggingEvidence1

T1056.001 — Input Capture: Keylogging (Collection)

T1539Steal Web Session CookieEvidence1

chrome_remote : Backdoor via le protocole Chrome DevTools (CDP), WebSocket persistant vers le C2, injection JavaScript, vol de cookies/credentials

Discovery

1 technique

T1497.001System ChecksEvidence1

Anti-VM : module stats vérifiant CPU/hardware, résultats envoyés au C2 pour bloquer les sandboxes

Collection

2 techniques

T1056.001KeyloggingEvidence1

T1056.001 — Input Capture: Keylogging (Collection)

T1115Clipboard DataEvidence1

T1115 — Clipboard Data (Collection)

Command and Control

3 techniques

T1071.001Web ProtocolsEvidence1

Phase 1 : Script initial injecté dans le projet Xcode, contact C2 via /a

T1568Dynamic ResolutionEvidence1

T1568 — Dynamic Resolution (Command and Control)

T1573.001Symmetric CryptographyEvidence1

chiffrement AES-256-CBC avec IV aléatoire par transmission

Exfiltration

1 technique

T1041Exfiltration Over C2 ChannelEvidence1

Phase 2 : Reconnaissance hôte (OS, username), exfiltration vers le C2

Impact

2 techniques

T1485Data DestructionEvidence1

T1485 — Data Destruction (Impact)

T1490Inhibit System RecoveryEvidence1

T1490 — Inhibit System Recovery (Impact)

Indicators of compromise

Observables

77 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.

View all in app →

Indicator values are available in Mallory. Pivot on every hash, domain, URL, and IP, or pipe them straight into your SIEM.View all in Mallory

Activity feed

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

View more in app →

cyberveilleNews · Aug 2, 2026XCSSET v40 : nouvelle version du malware macOS avec architecture furtive et modules avancés | CyberVeilleMalware macOS targeting Apple developers via a supply-chain compromise of legitimate Xcode projects on GitHub. It injects a downloader script into Xcode projects, activates when the developer builds locally, infects other Xcode projects on the compromised host, loads modules in memory, steals data and credentials, manipulates crypto wallets, weakens defenses, and maintains fileless persistence.Read more ↗

Is this in your environment?See whether this family's indicators match your telemetry and which of your assets are exposed to the CVEs associated with it.

Check your exposure

Mallory platform

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start Free Trial Open in App ↗

IOC matching77Match every observed IP, domain, and hash against your live telemetry.

Associated threat actorsGroups linked to this family, with evidence pinned to each claim.

Associated vulnerabilitiesCVEs linked to this family, with the reporting behind each link.

Detection signaturesYARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping22Every documented technique, ranked by evidence weight.

Researcher chatterReddit, Mastodon, and CTI community discussion around this family.

XCSSET v40

Tracked since Aug 3, 2026 · Updated 3 months ago

Trending this weekNot trendingOutside this week’s top 100

Mention activity · 30 daysNo mention activity in the last 30 days.

Vulns0Associated

Actors0Associated

ATT&CK22Techniques

IOCs77Tracked

Is this in your environment?See whether this family's indicators match your telemetry and which of your assets are exposed to the CVEs associated with it.

Check your exposure