XCSSET macOS Malware Returns with Stealthy Memory Exploits
The Resurgence of XCSSET
Following several months of quiet activity, a notorious malware family targeting software developers has returned with a stealthy upgrade. This malicious tool leaves almost no trace on local disk drives. Security researchers at Palo Alto Networks recently uncovered XCSSET macOS malware version 40 in active campaigns. Since April 2026, this threat has propagated primarily through compromised Xcode projects, the primary development environment for Apple platforms.
Infection Mechanism and Memory Execution
The infection process does not trigger upon simple file downloading. Instead, it initiates during project compilation. As soon as a developer builds the infected codebase, a background script executes automatically. Subsequently, this script contacts a command-and-control server and retrieves additional functional modules. The final payload operates entirely within system RAM. Meanwhile, the malware deletes all temporary files from the disk, greatly complicating forensic analysis.
Self-Propagation Across Supply Chains
This threat possesses potent self-propagation capabilities. Specifically, it infects every local Xcode project discovered on the target workstation. Furthermore, it compromises Git repository hooks, effectively transforming developer machines into vectors for supply chain attacks. Analysts identified seventeen functional modules in this iteration. Their capabilities range from harvesting data in Apple Notes and the system clipboard to complete browser hijacking.
Hijacking Google Chrome via CDP
The updated module targeting Google Chrome warrants particular scrutiny. The malware wraps the legitimate browser executable in a launcher script. This script launches Chrome with customized flags that activate the Chrome DevTools Protocol on a local port.
Through this local interface, attackers execute arbitrary JavaScript inside active browser tabs. Consequently, adversaries harvest authentication cookies, extract passwords, and manipulate cryptocurrency wallet addresses. They can even execute system commands via crafted browser console entries. Google acknowledged this finding and confirmed that equivalent protections exist in Windows, with macOS defenses currently under active development.
Telegram Spoofing and System Persistence
Another major addition involves impersonating the Telegram messaging application. The malware downloads a forged binary, removes the genuine application, and signs the fake app locally without a valid certificate. Next, it forcefully terminates the active Telegram process, prompting the user to launch the infected substitute.
Beyond data exfiltration, the malware actively degrades core macOS defenses. It disables automatic system updates, blocks telemetry reporting to Apple, and disrupts security updates for XProtect. Additionally, it resets automation permissions to trick users into re-granting access. To maintain stealth, the malware re-encrypts its code and network traffic dynamically while rebuilding server-side executables multiple times daily.
Recommended Mitigation Strategies
To defend against this threat, Palo Alto Networks advises monitoring for anomalous AppleScript processes. Security teams must enforce strict path verification for browser launches and restrict unauthorized file modifications. Furthermore, organizations should track configuration changes via the defaults command-line utility. Finally, administrators must audit self-signed applications bypassing Gatekeeper and implement automated dependency verification for open repositories before integration.
Support Our Threat Intelligence
If you find our technology report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
