A sophisticated new version of the XCSSET malware is compromising macOS users by infiltrating Xcode projects and GitHub repositories. The malware features advanced modules to hijack Chrome and Telegram.

Key Takeaways

  • XCSSET v40 uses compromised Xcode projects to infect macOS systems.
  • New modules include a Chrome hijacker and a Telegram trojanizer.
  • The malware can intercept web traffic, credentials, and cryptocurrency transactions.
  • It actively attempts to disable macOS security features like XProtect and TCC.

Cybersecurity researchers have identified a dangerous resurgence of the XCSSET malware. The latest version, designated as v40, is specifically targeting thousands of macOS users by exploiting compromised Xcode projects and GitHub repositories. This evolution marks a significant shift in the malware's sophistication and evasion capabilities.

According to researchers at Palo Alto Networks' Unit 42, the infection chain begins when threat actors inject malicious downloader scripts into benign files within vulnerable Git repositories. Once a developer builds these compromised projects, the infection takes hold, allowing XCSSET to compromise every other Xcode project on the system and propagate further through shared source code.

Why This Matters

BozokMedia analysis shows that this is not just a localized threat but a potential supply-chain attack. By targeting the development environment, attackers can turn legitimate software developers into unwitting distributors of malware, compromising the entire software ecosystem.

The shift toward targeting the developer's IDE represents a highly strategic move to bypass traditional perimeter defenses.

The new iteration of XCSSET introduces two highly specialized modules. The Chrome Hijacker utilizes the Chrome DevTools Protocol (CDP) to intercept web traffic, including sensitive MetaMask transactions and login credentials. Simultaneously, the Telegram Trojanizer replaces the legitimate Telegram Desktop application with a malicious clone designed to intercept private communications.

Historical Background

XCSSET has been a persistent threat to the macOS ecosystem since at least 2021. In previous iterations, the malware has been known to exploit zero-day vulnerabilities and has previously included modules for cryptocurrency theft, as highlighted by Microsoft in late 2025.

Did You Know?: XCSSET is designed to aggressively disable macOS security layers, including XProtect, MRT, and TCC, to remain undetected.

Frequently Asked Questions

1. How can developers protect their workflows?
It is critical to scan all open-source dependencies and monitor for anomalous AppleScript activity or unauthorized browser modifications.

2. Can this malware steal my crypto?
Yes, the Chrome hijacking module is specifically designed to intercept and manipulate web-based transactions, including those involving MetaMask.