A macOS malware family that hides inside developers' own Xcode projects is back after months of quiet, and the new version goes considerably further than stealing files. Researchers Adva Gabay and Noa Dekel at Palo Alto Networks' Unit 42 published an analysis of XCSSET v40 on July 31, describing malware that takes over Google Chrome from the inside, swaps Telegram Desktop for a trojanized copy, and quietly switches off the Mac's own security update channel.
The infection starts in source code. XCSSET injects a downloader script into ordinary-looking files in Xcode projects and Git repositories, and the developer's Mac is only compromised when they build that project locally. Unit 42 says that since early April 2026 the malware has ridden this supply chain into the Xcode projects of dozens of legitimate applications with thousands of active users, and that once it lands it can infect every other Xcode project on the machine. The researchers saw the heaviest concentration of attacks against developers in South Asia.
What's affected
Anyone building Apple software on macOS, plus the users of the apps they ship. XCSSET was first documented by Trend Micro in 2020, and Microsoft analyzed two later versions in March and September 2025. Unit 42 counted 17 separate modules in v40, delivered from the command and control server and run in memory, including keyloggers, clipboard hijackers and browser hijackers.
Chrome and Telegram get rewritten
The two new modules are the notable part. The first wraps the real Google Chrome binary in a malicious script, then relaunches Chrome with its built-in debugging interface (the Chrome DevTools Protocol) exposed on a local port. A dropped binary called chrome_remote connects to that port and can run arbitrary JavaScript inside the victim's live browsing session. It hooks the browser's network functions to skim credentials and API tokens, overrides password manager autofill, and intercepts MetaMask's Ethereum provider to alter cryptocurrency wallet addresses. It can also relay shell commands, giving the operators a fileless reverse shell running under the legitimate Chrome process. Unit 42 reported the technique to Google, which already blocks this behavior on Windows and is working on extending the same protection to macOS.
The second module, added in May, replaces Telegram Desktop outright. It downloads a prepared malicious Telegram.app, deletes the real one, code-signs the fake, and kills the running process so the victim relaunches the attacker's copy. Earlier XCSSET versions only stole Telegram's chat history and local keys, so this is a real escalation in access.
Turning off the Mac's defenses
v40 also works to keep itself alive. It disables the SoftwareUpdate configuration channel, which stops the machine pulling updates to XProtect, MRT and TCC as well as Apple's Rapid Security Response patches. It runs a loop that kills the CloudTelemetryService process so local security data never reaches Apple, and it holds an exclusive file lock on the XProtect signature database so new rules cannot be written to disk. If a user denies its automation prompt, it runs tccutil reset AppleEvents and asks again while masquerading as System Settings or Xcode. Hosts that look like virtual machines are cut off and sent no further modules, which keeps the core logic away from automated sandboxes.
Detection is deliberately hard. The loader is recompiled on the command and control server every few hours, and Unit 42 saw eight distinct hashes served from a single endpoint within 24 hours. Each module is encrypted with a per-build key and a fresh initialization vector, and internal strings and function names are scrambled before distribution. The team broke that obfuscation using pattern matching and LLM assistance to recover the operators' original names for the code.
What you should do
Treat cloned repositories as untrusted until they have been built somewhere disposable, because the trigger is the build itself. On developer machines, review Git hooks, launch daemons and any unfamiliar preference domains written by the defaults utility, and check whether Chrome is being launched by a wrapper script rather than directly. A Mac that has quietly stopped receiving XProtect updates deserves a closer look. Our earlier coverage of a macOS stealer that locks the screen to harvest passwords and of North Korean Mac malware built to confuse AI triage tools points the same way: macOS threats are increasingly built against the platform's own defenses rather than around them.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.