XCSSET v40 malware has emerged as a significant threat to macOS developers, utilizing compromised Xcode projects to infiltrate and execute a supply chain attack. The malware’s latest version spreads through these infected projects, posing a risk to developers and organizations that rely on their software.
XCSSET’s Stealthy Evolution
Originally identified in 2020, XCSSET has continually evolved, focusing on stealth and scalability. The malware uses memory-based execution and rapidly changing payloads to minimize detection. Recent reports indicate an increased focus on developers in South Asia, with infected projects surfacing in open-source repositories.
Unit 42 analysts detected the v40 activity in April 2026, noting a resurgence in May with additional components. According to Palo Alto Networks, XCSSET has been embedded into numerous Xcode projects linked to active applications, highlighting the potential scale of the threat.
Exploiting Chrome DevTools Protocol
XCSSET v40 introduces a backdoor that exploits the Chrome DevTools Protocol (CDP), a legitimate browser automation feature. By wrapping the genuine Chrome app in a malicious launcher, it reactivates XCSSET each time Chrome is opened, enabling CDP on a local port.
This mechanism allows the malware to run scripts within active browser sessions, steal cookie tokens, and monitor web traffic. The use of a trusted browser functionality, rather than a flaw, underscores the significance of recent Chrome DevTools security updates.
Mitigation Strategies for Developers
Developers must scrutinize project settings and source code to detect hidden scripts that could trigger further attacks. XCSSET’s ability to execute remote commands via Chrome makes traditional file-based security checks insufficient.
Unit 42 recommends vigilance for unusual AppleScript activity, unauthorized browser launches, and irregular preference domains. Isolating ad hoc-signed binaries, scanning dependencies, and inspecting Xcode projects for unfamiliar scripts are crucial steps in mitigating this threat.
Conclusion: Strengthening Security Measures
The XCSSET v40 campaign highlights the vulnerabilities inherent in trusted development tools. Organizations are urged to monitor behavior across repositories and network connections, verify project origins, and update security protocols to mitigate such threats.
Ultimately, safeguarding against XCSSET v40 requires an understanding of its techniques and a commitment to maintaining robust security practices across development environments and tools.
