Researchers at Palo Alto Networks’ Unit 42 have documented a new version of XCSSET—a macOS malware family active since 2021—that spreads through GitHub repositories containing compromised Xcode projects. When a developer downloads and builds an infected project, XCSSET installs itself and then compromises every other Xcode project on the same system, propagating further as developers share their source code. Unit 42 observed the new variant, labeled v40, in two distinct attack waves in mid-April and early May 2026, targeting thousands of macOS users.
Version 40 introduces two new modules on top of the 17 existing ones that already handle credential theft, keystroke logging, clipboard manipulation, and data exfiltration. The Chrome hijacker wraps the browser in a malicious launcher and opens the Chrome DevTools Protocol on a local port, letting the attacker inject JavaScript fetched from a command-and-control server—intercepting web traffic, session cookies, MetaMask transactions, and login credentials in real time. It also enables a fileless reverse shell running through the browser process. The Telegram trojanizer deletes the legitimate Telegram Desktop application and silently replaces it with a malicious copy, though the exact capabilities of the replacement app remain unknown because its configuration was encrypted. XCSSET v40 also adds new detection-evasion measures: the loader is periodically recompiled on the C2 server, encryption keys rotate between inbound and outbound communications, and function names are obfuscated to defeat static analysis.
How to check if you’re affected
Affected devices are macOS machines used for software development with Xcode installed. If you downloaded Xcode projects from GitHub and built them locally in April or May 2026, your machine may be infected. Signs include XCSSET inserting a downloader script into Xcode project files you didn’t modify, unexpected Chrome behavior, or a Telegram application that differs in size or behavior from the official release. Affected products include macOS Xcode projects cloned from public or shared repositories—inspect build scripts in any recently cloned project for unfamiliar shell commands before building.