Loading story…
Palo Alto Networks Unit 42 reported on XCSSET v40, the latest version of the long-running macOS malware family that targets developers through Xcode projects. The updated strain continues the threat’s focus on compromising Apple developer environments, using malicious code embedded in Xcode projects to infect systems and persist within development workflows.
Researchers said the new analysis decoded the malware’s logic with advanced pattern matching and AI-assisted techniques, providing a deeper look at how the latest variant operates. The findings underscore that XCSSET remains an active and evolving developer-focused macOS threat, with continued refinement of its capabilities aimed at software development environments rather than broad consumer targeting.
Pull IOCs and campaign context straight into your stack.
3 events from the most recent confirmed update back to the earliest known activity.
A Gurucul threat research post documented XCSSET v40 indicators of compromise, including domains, URLs, IP addresses, a SHA-1 hash, and detection queries for threat hunting. The report also said recent activity particularly targeted Apple developers in South Asia.
Palo Alto Networks Unit 42 identified XCSSET v40 activity in mid-April 2026 and observed a second wave in early May 2026. The campaign embedded malware in poisoned Xcode projects tied to dozens of applications with active users and introduced a Chrome DevTools Protocol backdoor for cookie theft and fileless command execution.
Unit 42 published a deep dive into the latest XCSSET version, describing it as an evolved macOS malware family targeting developers through Xcode. The analysis says researchers used advanced pattern matching and AI to decode the malware's logic.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 77 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
6 references tracked. Mallory keeps watching after this page renders.
bleepingcomputer.com
Open sourcecommunity.gurucul.com
Open sourcecybersecuritynews.com
Open sourcecyberveille.ch
Open sourcemalware.news
Open sourceunit42.paloaltonetworks.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A new variant of the XCSSET macOS malware has been identified by Microsoft Threat Intelligence, demonstrating significant advancements in its capabilities and targeting. This updated version of XCSSET is specifically designed to infect Xcode projects, which are commonly used by software developers building applications for macOS. The malware leverages the sharing of Xcode project files among developers as its primary propagation method, allowing it to spread stealthily within development environments. Researchers have observed that the latest variant introduces sophisticated encryption and obfuscation techniques, making detection and analysis more challenging. One of the key enhancements is the use of run-only compiled AppleScripts, which enable stealthy execution and help evade security tools. The malware has expanded its data exfiltration capabilities to include the theft of browser data from Mozilla Firefox, in addition to previously targeted browsers. To achieve this, it installs a modified build of the open-source HackBrowserData tool, which is capable of decrypting and exporting sensitive browser data. Another notable feature is the addition of a clipper sub-module that actively monitors the system clipboard for patterns matching cryptocurrency wallet addresses. When such an address is detected, the malware replaces it with an attacker-controlled address, effectively hijacking cryptocurrency transactions and redirecting funds to the threat actors. The persistence mechanisms have also been improved, with the malware now creating LaunchDaemon entries and deploying a fake System Settings.app in the /tmp directory to maintain its foothold on compromised systems. The infection chain has been updated, particularly in the fourth stage, where an AppleScript application is used to execute a shell command that fetches the final-stage AppleScript responsible for system information collection and launching various sub-modules. Microsoft notes that the new variant has been observed only in limited attacks so far, but its advanced features and modular design pose a significant threat to macOS users, especially developers. The malware's ability to siphon sensitive data, including Notes, browser credentials, and cryptocurrency wallets, increases the risk of financial loss and data breaches. Enhanced error handling and the use of multiple persistence techniques further complicate remediation efforts. Microsoft has shared its findings with Apple to aid in the development of detection and mitigation strategies. The exact initial distribution vector remains unclear, but the reliance on infected Xcode projects highlights the importance of secure development practices. Organizations and individual developers are urged to review their Xcode environments for signs of compromise and to implement robust endpoint protection solutions. The discovery of this new XCSSET variant underscores the evolving threat landscape for macOS and the need for continuous vigilance among software development communities.
Jun 29, 2026
Researchers reported that an updated **XCSSET** malware strain expanded its data-theft capabilities on **macOS**, using malicious AppleScript files to collect and compress sensitive data from multiple applications before exfiltrating it to attacker-controlled infrastructure. The malware was found targeting **Telegram** session data stored in application sandbox and group container directories, creating a path for account takeover on another Mac, while also harvesting information from **Contacts, Evernote, Notes, Opera, Skype, and WeChat**. The updated malware also targeted **Google Chrome** by displaying a fake privilege prompt to obtain the browser’s `safe_storage_key`, which it then used to decrypt and upload stored passwords and other sensitive data. Researchers said the operators rotated multiple command-and-control domains and IP addresses and modified the malware’s Xcode project infection chain so newer variants downloaded payloads remotely instead of embedding additional malicious files locally.
Aug 14, 2026
Threat researchers reported a renewed surge of **Odyssey Stealer** activity targeting **macOS**, with infections spreading rapidly across multiple regions. The malware is typically delivered via social engineering—masquerading as legitimate software updates, fake apps, or cracked tools—and is designed to steal high-value data including **cryptocurrency wallets**, browser-stored credentials (e.g., *Chrome* and *Safari*), personal documents, and items stored in the macOS **Keychain**. Moonlock Lab telemetry described a sharp increase in detections and a fast-expanding geographic footprint, consistent with a coordinated campaign and improved stealth/evasion techniques. In parallel, analysis of Apple’s built-in malware defenses noted an unusual **XProtect** update (version **5327**) that significantly expanded a newer YARA ruleset file, `XPScripts.yr`, focused on detecting malicious **OSAScript** (including AppleScript) content at execution time via the Open Scripting framework. The update increased OSAScript-focused rules from 2 to 14, reflecting growing abuse of lightweight, script-driven infection chains in recent macOS stealer campaigns (including AMOS/SOMA), where victims are coached into running obfuscated Terminal commands and downloading payloads (e.g., via `curl`) to avoid quarantine controls. Together, the reporting indicates escalating macOS infostealer pressure and corresponding defensive tuning by Apple to better detect script-based tradecraft used to bootstrap these infections.
Jun 29, 2026