XCSSET returns to infect Macs when developers build poisoned Xcode projects

Palo Alto Networks Unit 42 detailed a rebuilt version of XCSSET, macOS malware that spreads through Xcode developer projects. The actors compromise Git repositories and inject a downloader into ordinary files inside a project, so that when a developer builds the cloned project, a hidden loader runs under their own account with no permission prompt. It then infects every other Xcode project on the machine and propagates through shared code. Version 40 hides its logic in memory, generates polymorphic payloads, and adds a Chrome hijacker that drives the browser through its debugging protocol plus a component that trojanizes Telegram. Seventeen modules handle credential, keystroke, clipboard, and browser theft.

Check

Inspect Xcode projects, especially shared or cloned ones, for unexpected build scripts or run phases before building them, and watch developer machines for Chrome launched with debugging enabled.

Affected

macOS developers who build Xcode projects cloned from Git repositories; a hidden loader runs at build time under the developer's account, spreads to other local projects, and steals credentials and browser data.

Fix

Review third-party Xcode projects before building, build untrusted ones in isolated environments, keep macOS and tools patched, and monitor for browsers launched with remote debugging and unexpected outbound connections.