New XCSSET variant targets macOS devs via compromised Xcode projects

XCSSET v40 is a new variant of the macOS malware targeting developers via compromised Xcode projects and GitHub repositories. The threat actor injects a downloader script into benign files within vulnerable Git-hosted Xcode projects. When developers build the compromised project, the malware installs and then spreads to every other Xcode project on the system. The infection follows a four-stage chain and deploys 17 separate modules enabling credential theft, keystroke logging, clipboard manipulation, browser hijacking, and data exfiltration. Two new modules were introduced: (1) A Chrome hijacker that wraps Chrome in a malicious launcher, enables Chrome DevTools Protocol (CDP) on a local port, fetches JavaScript from a C2 server, intercepts web traffic including credentials, cookies, and MetaMask transactions, manipulates payments on the fly, and enables fileless reverse shell system command execution. (2) A Telegram trojanizer that deletes the legitimate Telegram Desktop app and replaces it with a malicious version to intercept communications. Evasion techniques include periodically re-compiling the loader on the C2 server, using separate encryption keys for inbound and outbound communications, and obfuscating function names, variables, and strings with build-unique ciphers. The malware attempts to disable macOS security features including XProtect, MRT, TCC, and Rapid Security Response, terminates Apple's CloudTelemetryService, and prevents XProtect signature updates. Two distinct attack waves were observed in mid-April and early May 2026.