XCSSET v40 Malware Targets macOS Xcode Supply Chain and Hijacks Chrome and Telegram

Security researchers from Palo Alto Networks Unit 42 and Microsoft Security have detailed XCSSET v40, a macOS‑focused malware family that compromises Xcode projects (.xcodeproj) to poison the software development supply chain. The malware injects obfuscated scripts during the build process, uses novel persistence techniques, and can spread to other Xcode projects on the infected workstation.

After a successful supply‑chain infection, a multi‑stage loader runs in memory, downloading encrypted modules that hijack Google Chrome sessions via the Chrome DevTools Protocol and replace the legitimate Telegram app with a trojanized version. The modules exfiltrate browser cookies, keystrokes, clipboard data and other credentials, enabling broad downstream attacks on end‑users of the compromised binaries.

Researchers note that the increasing complexity of XCSSET’s evasion tactics requires AI‑assisted decoding and behavioral analysis. Mitigation recommendations include strict integrity checks on third‑party Xcode projects, checksum verification of build artifacts, deployment of advanced endpoint detection and response tools, and regular audits of build scripts for unauthorized modifications.