What Changed
Unit 42 has analyzed XCSSET v40, a new version of the macOS malware family that spreads through Xcode projects. Unit 42 has tracked it since mid-April 2026, saw a second wave with more modules in early May, and says it has hidden in the Xcode projects of dozens of legitimate apps with thousands of active users. Many targets were developers in South Asia.
Infection starts when a developer builds a poisoned project. A hidden run-script phase contacts the C2 server, fingerprints the Mac, stages a loader in /tmp, and then deletes its files once the core “boot” module is running in memory. The malware also infects every other Xcode project on the machine and plants Git pre-commit hooks.
New In Version 40
- Chrome hijacking: a wrapper starts Chrome with the DevTools Protocol enabled, and a
chrome_remotebinary injects JavaScript into every page to steal credentials and tokens and to change MetaMask transactions. It can also act as a reverse shell. - Telegram trojanizer: added in May, it replaces Telegram Desktop with an ad hoc-signed copy supplied by the C2.
- Fileless persistence: a Base64 payload is stored under random-looking keys in a macOS
defaultsdomain and read back to reinfect the Mac. - Weakened defences: it turns off SoftwareUpdate configuration downloads, kills the CloudTelemetryService process, locks the XProtect signature database and resets AppleEvents TCC decisions so the permission prompt reappears.
- Evasion: the loader is recompiled every few hours (eight hashes in one day), modules use per-build AES keys, and Macs that look like virtual machines get no further modules.
Infrastructure
Unit 42 lists about 40 C2 domains registered in early 2026 and left to age before use, now including .in names alongside .ru ones. All four operator IPs share one SSL thumbprint, reused SSH keys and an RDP certificate.
Know what matters before your first meeting.
Weekday mornings. Five minutes. What changed in security, why it matters.
By subscribing you agree to our Privacy Policy.
Free. Weekday mornings. 5 minutes or less.
What To Verify First
- Check Xcode projects from GitHub for unexpected run-script build phases before building them.
- Alert on unusual
osascriptactivity, newdefaultsdomains and ad hoc-signed copies of apps like Telegram. - Confirm XProtect and SoftwareUpdate settings on developer Macs have not been changed.
Source Context
This item was rebuilt from the following primary sources and original reporting:
Related In The Daily Brief
See this item in The 5-Minute Cyber Brief
Newer CyberExperts coverage on this topic
This article still works as background. If you want the current picture, start with the freshest related coverage below and today's brief.
Coder’s registry infrastructure compromised to push malicious modules
The Coder incident is a supply-chain lesson in miniature: once attackers can tamper with trusted module distribution, defenders are no longer verifying...
Attackers Turn Trusted Node.js Runtime Into Malware Delivery Tool in Targeted Attacks
The useful lesson in this campaign is not that Node.js is bad. It is that adversaries keep choosing legitimate runtimes defenders already...
HPE patches critical ArubaOS-CX remote code execution flaw
ArubaOS-CX deserves attention because switching software rarely gets treated with the same urgency as identity or edge security until exploitation arrives. A...
Monday’s brief: GlobalProtect logins without passwords, then SonicWall, AhsayCBS and NetScaler
The fastest way to catch up on what changed after this article was published.
Start your morning with the signal that matters.
Get the biggest cybersecurity developments, why they matter, and where to go deeper on CyberExperts.
By subscribing you agree to our Privacy Policy.
Free. Weekdays. Built for operators.
