Loading story…
Palo Alto Networks Unit 42 reported on XCSSET v40, the latest version of the long-running macOS malware family that targets developers through Xcode projects. The updated strain continues the threat’s focus on compromising Apple developer environments, using malicious code embedded in Xcode projects to infect systems and persist within development workflows.
Researchers said the new analysis decoded the malware’s logic with advanced pattern matching and AI-assisted techniques, providing a deeper look at how the latest variant operates. The findings underscore that XCSSET remains an active and evolving developer-focused macOS threat, with continued refinement of its capabilities aimed at software development environments rather than broad consumer targeting.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
Unit 42 published a deep dive into the latest XCSSET version, describing it as an evolved macOS malware family targeting developers through Xcode. The analysis says researchers used advanced pattern matching and AI to decode the malware's logic.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
malware.news
Open sourceunit42.paloaltonetworks.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Threat researchers reported a renewed surge of **Odyssey Stealer** activity targeting **macOS**, with infections spreading rapidly across multiple regions. The malware is typically delivered via social engineering—masquerading as legitimate software updates, fake apps, or cracked tools—and is designed to steal high-value data including **cryptocurrency wallets**, browser-stored credentials (e.g., *Chrome* and *Safari*), personal documents, and items stored in the macOS **Keychain**. Moonlock Lab telemetry described a sharp increase in detections and a fast-expanding geographic footprint, consistent with a coordinated campaign and improved stealth/evasion techniques. In parallel, analysis of Apple’s built-in malware defenses noted an unusual **XProtect** update (version **5327**) that significantly expanded a newer YARA ruleset file, `XPScripts.yr`, focused on detecting malicious **OSAScript** (including AppleScript) content at execution time via the Open Scripting framework. The update increased OSAScript-focused rules from 2 to 14, reflecting growing abuse of lightweight, script-driven infection chains in recent macOS stealer campaigns (including AMOS/SOMA), where victims are coached into running obfuscated Terminal commands and downloading payloads (e.g., via `curl`) to avoid quarantine controls. Together, the reporting indicates escalating macOS infostealer pressure and corresponding defensive tuning by Apple to better detect script-based tradecraft used to bootstrap these infections.
Jun 29, 2026
A new wave of the GlassWorm malware campaign is actively targeting macOS users by distributing trojanized Visual Studio Code (VS Code) extensions through the OpenVSX marketplace. This fourth iteration marks a significant shift from previous campaigns, which primarily targeted Windows systems, and now leverages AES-256-CBC–encrypted JavaScript payloads embedded in extensions such as `studio-velte-distributor.pro-svelte-extension`, `cudra-production.vsce-prettier-pro`, and `Puccin-development.full-access-catppuccin-pro-extension`. The malware is designed to steal credentials for platforms like GitHub, npm, and OpenVSX, as well as cryptocurrency wallet data, and it supports remote access via VNC and SOCKS proxy routing. Notably, the latest campaign employs AppleScript for execution on macOS and introduces a 15-minute delay before activating its malicious logic, a tactic intended to evade detection by automated sandbox analysis. Researchers from Koi Security identified that the threat actor behind GlassWorm has adapted its techniques over four distinct waves since October, evolving from using invisible Unicode characters and compiled Rust binaries to the current encrypted JavaScript approach. The malware's command and control infrastructure is now based on the Solana blockchain, utilizing transaction memos with base64-encoded URLs to maintain decentralized and resilient control, making takedown efforts extremely challenging. Over 50,000 downloads of the malicious extensions have been recorded, and the campaign's infrastructure has been linked to previous waves through shared IP addresses and encryption keys. The sophistication and persistence of GlassWorm highlight the growing threat to macOS developers and users who rely on third-party extension marketplaces for their development environments.
Jun 29, 2026
Threat actors are increasingly targeting macOS users with **infostealers** and distribution-as-a-service models, reflecting a broader “gold rush” in Apple-focused malware development. Reporting highlights macOS stealers targeting browser credentials and cryptocurrency assets (including seed phrases) and notes tactics to evade Apple controls such as obtaining valid Apple developer signatures to bypass *Gatekeeper*; one cited example is *MacSync* being notarized and signed under Team ID `GNJLS3UYZ4`. The same reporting describes ecosystem-scale enablement, including large-scale compromise of WordPress sites for distribution and novel command-and-control approaches such as using blockchain smart contracts (e.g., on **BNB Smart Chain**), alongside paid-traffic abuse (e.g., promoting malicious AI chat content via ads) to push stealer payloads. Separately, a Darktrace-described investigation details a **multi-stage macOS malware** campaign that prioritizes *social engineering* over exploitation to defeat Apple’s **Transparency, Consent, and Control (TCC)** privacy framework. Victims are lured via phishing to open an AppleScript masquerading as a document (`Confirmation_Token_Vesting.docx.scpt`), which displays a fake “Compatibility” error and instructs the user to launch a “Compatibility Wizard” (e.g., using a keyboard shortcut) that effectively tricks them into authorizing execution and granting access. Together, the reporting indicates macOS threats are increasingly succeeding by combining credential/crypto theft objectives with user-prompt manipulation and trust-abuse techniques rather than relying on kernel or sandbox escapes.
Jun 29, 2026