macOS Developers Targeted as XCSSET v40 Poisons Xcode Projects, Hits Major Companies

1. Incident Overview

XCSSET is a macOS‑focused trojan active since 2021; in September 2025 Microsoft first warned about XCSSET spreading via polluted Xcode projects, and Unit 42 observed two waves of XCSSET v40 attacks in April–May 2026.

2. New Attack Stages: Detailed Four‑Stage Infection Chain

2.1 First Stage: Initial Delivery

Attackers compromise vulnerable Git repositories and inject a malicious downloader script into legitimate Xcode project source files, which are then pushed to GitHub for developers to clone.

2.2 Second Stage: Build‑time Trigger

When developers clone and build the polluted projects, the injected script executes automatically as part of the normal build process, delivering a supply‑chain poisoning attack without any user interaction.

2.3 Third Stage: System‑wide Infection

Once a developer machine is infected, XCSSET scans all local Xcode projects and injects malicious code into each, ensuring that even freshly cloned clean projects become contaminated after passing through the compromised host.

2.4 Fourth Stage: Modular Payload Deployment

The infection culminates in the deployment of a 17‑module payload, each module performing distinct malicious functions such as credential theft, keylogging, clipboard manipulation, browser hijacking, and data exfiltration.

3. New Module One: Chrome Browser Hijack

XCSSET v40 introduces the most sophisticated browser‑attack component in the family, hijacking Chrome via a malicious launcher that enables the Chrome DevTools Protocol (CDP) on a local port and fetches attacker‑controlled JavaScript from the C2 server.

Man‑in‑the‑Middle : intercepts all web traffic, including clear‑text credentials and session cookies.

Cryptocurrency Transaction Manipulation : targets MetaMask and similar wallet extensions, replacing the destination address of transfers with an attacker‑controlled wallet.

Fileless Backdoor : uses CDP to execute system commands, creating a fileless reverse shell; Google has already blocked this technique on Windows Chrome and is extending protection to macOS.

4. New Module Two: Telegram Trojanizer

The variant adds a "Telegram trojanizer" that replaces the legitimate Telegram Desktop client with a malicious copy. Because Telegram Desktop is open source, attackers can craft a near‑identical binary that contains a backdoor, allowing interception of messages, files, and voice calls.

5. Detection‑Evasion Upgrades

Server‑side dynamic recompilation : the loader is recompiled on the C2 server with a new encryption key for each build, hindering static analysis.

Bidirectional encrypted communication : separate keys are used for inbound and outbound traffic to resist traffic analysis.

Code obfuscation : function names, variable names, and strings are encrypted, rendering signature‑based detection ineffective.

Forced anti‑virus paralysis : the trojan attempts to disable macOS security layers including XProtect, MRT, TCC, and Rapid Security Response.

Cloud service hijack : terminates Apple’s CloudTelemetryService to stop telemetry reporting.

Update blocking : prevents updates to the XProtect signature database, ensuring the payload remains undetected even after Apple releases new signatures.

6. Mitigation Recommendations

For developers :

Inspect Git commit histories for anomalous code before building open‑source Xcode projects.

Run static analysis tools on third‑party dependencies to catch polluted repositories.

Build untrusted projects in isolated environments such as virtual machines.

For enterprise security teams :

Monitor abnormal AppleScript activity, which XCSSET heavily uses for lateral movement.

Detect unauthorized modifications to Chrome launch parameters.

Watch for suspicious changes to macOS defaults domains.

Be aware of ad‑hoc‑signed applications that bypass Gatekeeper.

Regularly audit code pulled from GitHub for signs of supply‑chain poisoning.

7. Conclusion

The resurgence of XCSSET v40 demonstrates the devastating potential of software supply‑chain attacks: by injecting malicious code into trusted development tools and open‑source projects, traditional defenses are largely bypassed. macOS developers must treat every downloaded Xcode project as a potential threat, perform security reviews before building, use isolated build environments, and continuously monitor system integrity.