XCSSET v40 Expands macOS Developer Malware Targeting Through Xcode

Linked entities

Related entities

Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.

Open in app →

Malware

2 linked

XCSSET XCSSET v40

Affected products

2 linked

XcodeMacos

Organizations

1 linked

Apple

Observables

77 linked

Domain••••••.comIPv4 address•••.•••.••.•••URLhttps://•••••••.•••/••••••SHA-1 hash••••••••••••••••••••••••••••••••••••••••Domain••••••••••.comIPv4 address•••.•••.••.•••URLhttps://•••••.•••/••••••Domain••••••.ru+69

Indicator values are masked on this page. View all 77 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.

Do you run this?Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.

Hunt This Malware

Source coverage

Sources

6 references tracked. Mallory keeps watching after this page renders.

Bleeping ComputerNews · Aug 4, 2026

New XCSSET variant targets macOS devs via compromised Xcode projectsOpen source ↗

Gurucul Threat ResearchNews · Aug 3, 2026

The Xcode Assassin Returns: A Deep Dive Into the Latest XCSSET Version | Community Portal | GuruculOpen source ↗

Cyber Security NewsNews · Aug 3, 2026

XCSSET v40 Abuses Chrome DevTools Protocol to Steal Cookies and Run CommandsOpen source ↗

CyberveilleNews · Aug 2, 2026

XCSSET v40 : nouvelle version du malware macOS avec architecture furtive et modules avancés | CyberVeilleOpen source ↗

Malware NewsNews · Jul 31, 2026

The Xcode Assassin Returns: A Deep Dive Into the Latest XCSSET Version - Malware Analysis - Malware Analysis, News and IndicatorsOpen source ↗

Palo Alto Networks Unit 42 BlogNews · Jul 31, 2026

The Xcode Assassin Returns: A Deep Dive Into the Latest XCSSET VersionOpen source ↗

On the same thread

A new variant of the XCSSET macOS malware has been identified by Microsoft Threat Intelligence, demonstrating significant advancements in its capabilities and targeting. This updated version of XCSSET is specifically designed to infect Xcode projects, which are commonly used by software developers building applications for macOS. The malware leverages the sharing of Xcode project files among developers as its primary propagation method, allowing it to spread stealthily within development environments. Researchers have observed that the latest variant introduces sophisticated encryption and obfuscation techniques, making detection and analysis more challenging. One of the key enhancements is the use of run-only compiled AppleScripts, which enable stealthy execution and help evade security tools. The malware has expanded its data exfiltration capabilities to include the theft of browser data from Mozilla Firefox, in addition to previously targeted browsers. To achieve this, it installs a modified build of the open-source HackBrowserData tool, which is capable of decrypting and exporting sensitive browser data. Another notable feature is the addition of a clipper sub-module that actively monitors the system clipboard for patterns matching cryptocurrency wallet addresses. When such an address is detected, the malware replaces it with an attacker-controlled address, effectively hijacking cryptocurrency transactions and redirecting funds to the threat actors. The persistence mechanisms have also been improved, with the malware now creating LaunchDaemon entries and deploying a fake System Settings.app in the /tmp directory to maintain its foothold on compromised systems. The infection chain has been updated, particularly in the fourth stage, where an AppleScript application is used to execute a shell command that fetches the final-stage AppleScript responsible for system information collection and launching various sub-modules. Microsoft notes that the new variant has been observed only in limited attacks so far, but its advanced features and modular design pose a significant threat to macOS users, especially developers. The malware's ability to siphon sensitive data, including Notes, browser credentials, and cryptocurrency wallets, increases the risk of financial loss and data breaches. Enhanced error handling and the use of multiple persistence techniques further complicate remediation efforts. Microsoft has shared its findings with Apple to aid in the development of detection and mitigation strategies. The exact initial distribution vector remains unclear, but the reliance on infected Xcode projects highlights the importance of secure development practices. Organizations and individual developers are urged to review their Xcode environments for signs of compromise and to implement robust endpoint protection solutions. The discovery of this new XCSSET variant underscores the evolving threat landscape for macOS and the need for continuous vigilance among software development communities.

Sep 26, 2025

Updated XCSSET macOS Malware Steals Telegram Sessions and Browser Credentials

Researchers reported that an updated **XCSSET** malware strain expanded its data-theft capabilities on **macOS**, using malicious AppleScript files to collect and compress sensitive data from multiple applications before exfiltrating it to attacker-controlled infrastructure. The malware was found targeting **Telegram** session data stored in application sandbox and group container directories, creating a path for account takeover on another Mac, while also harvesting information from **Contacts, Evernote, Notes, Opera, Skype, and WeChat**. The updated malware also targeted **Google Chrome** by displaying a fake privilege prompt to obtain the browser’s `safe_storage_key`, which it then used to decrypt and upload stored passwords and other sensitive data. Researchers said the operators rotated multiple command-and-control domains and IP addresses and modified the malware’s Xcode project infection chain so newer variants downloaded payloads remotely instead of embedding additional malicious files locally.

Jun 24, 2021

Infostealers and Trojans Dominate Mac Malware as ClickFix Targets Corporate Access

Trojans and infostealers accounted for **54.2% of 37,898 macOS malware samples** processed by Point Wild in Q3 2026, outpacing potentially unwanted applications and backdoors. Its threat report identifies social engineering—particularly ClickFix lures that persuade users to paste malicious commands into Terminal—as a leading delivery mechanism. Infostealers including Odyssey, Atomic macOS Stealer (AMOS), MacSync, SHub, and ClickLock target browser passwords, cryptocurrency wallets, cloud credentials, SSH keys, and developer assets. Campaigns use trusted-brand and developer-tool impersonation, compromised brands, and malicious installers to reach developers, creatives, and knowledge workers, potentially extending access from individual Macs into corporate environments. Point Wild also highlighted developer-focused supply-chain attacks and DPRK-linked social engineering involving blockchain-based command-and-control. Point Wild reported active exploitation of **CVE-2026-65400**, described as a critical unauthenticated macOS Screen Sharing flaw, to gain root access and deploy the XMRig cryptocurrency miner. It also described a chain of legitimate macOS behaviors that could disable Kandji and CrowdStrike Falcon protections without administrator credentials or a kernel exploit; the Kandji issue was assigned **CVE-2026-39118**. Apple’s macOS Tahoe 26.4 Terminal-paste warning offers only partial protection because fake installers and malicious applications remain viable delivery routes. Recommended enterprise defenses include stronger credential management, scrutiny of Terminal-based installation instructions, monitoring impersonation infrastructure, and applying security controls consistently across Mac fleets.

Oct 9, 2026

XCSSET v40 Expands macOS Developer Malware Targeting Through Xcode

How this story unfolded

Gurucul publishes XCSSET v40 IOCs and South Asia targeting details

Unit 42 analyzes XCSSET v40 malware

Unit 42 observes XCSSET v40 campaign waves in April and May 2026

Related entities

Malware

Affected products

Organizations

Observables

Sources

See the full picture, correlated to your attack surface.

XCSSET v40 Expands macOS Developer Malware Targeting Through Xcode

How this story unfolded

Gurucul publishes XCSSET v40 IOCs and South Asia targeting details

Unit 42 analyzes XCSSET v40 malware

Unit 42 observes XCSSET v40 campaign waves in April and May 2026

Related entities

Malware

Affected products

Organizations

Observables

Sources

See the full picture, correlated to your attack surface.

XCSSET v40 Expands macOS Developer Malware Targeting Through Xcode

How this story unfolded

Gurucul publishes XCSSET v40 IOCs and South Asia targeting details

Unit 42 analyzes XCSSET v40 malware

Unit 42 observes XCSSET v40 campaign waves in April and May 2026

Related entities

Malware

Affected products

Organizations

Observables

Sources

See the full picture, correlated to your attack surface.

Related stories

New XCSSET macOS Malware Variant Targets Firefox and Cryptocurrency Wallets

Updated XCSSET macOS Malware Steals Telegram Sessions and Browser Credentials

Infostealers and Trojans Dominate Mac Malware as ClickFix Targets Corporate Access

XCSSET v40 Expands macOS Developer Malware Targeting Through Xcode

How this story unfolded

Gurucul publishes XCSSET v40 IOCs and South Asia targeting details

Unit 42 analyzes XCSSET v40 malware

Unit 42 observes XCSSET v40 campaign waves in April and May 2026

Related entities

Malware

Affected products

Organizations

Observables

Sources

See the full picture, correlated to your attack surface.

Related stories

New XCSSET macOS Malware Variant Targets Firefox and Cryptocurrency Wallets

Updated XCSSET macOS Malware Steals Telegram Sessions and Browser Credentials

Infostealers and Trojans Dominate Mac Malware as ClickFix Targets Corporate Access