Loading malware…
XCSSET is a modular macOS malware family that targets Apple developers through poisoned Xcode projects and related software supply-chain workflows. First publicly documented in 2020 and still active in later variants such as v40, it infects legitimate Xcode projects so that building a compromised project executes attacker-controlled code and can further contaminate other local or shared projects. The malware has been observed spreading through compromised repositories and injected build scripts, making developer environments and downstream applications a primary target set.
XCSSET is notable for combining supply-chain propagation, credential and session theft, browser abuse, and extensive defense evasion on macOS. Reported capabilities include stealing data from applications such as Telegram, Chrome, Contacts, Evernote, Notes, Opera, Skype, and WeChat; collecting files and application data from common user directories; capturing screenshots at intervals; keylogging; clipboard monitoring and manipulation; and exfiltrating stolen data over its command-and-control channel. Some variants also target browser credentials, cookies, autofill data, and cryptocurrency-wallet activity, including manipulation of MetaMask transactions. Newer versions introduced a Chrome hijacker that abuses the Chrome DevTools Protocol to intercept traffic, execute attacker-supplied JavaScript in browser sessions, and provide fileless remote command execution, as well as a Telegram trojanizer that replaces the legitimate desktop application with a malicious version.
The malware uses multiple persistence and concealment mechanisms. It has embedded itself in hidden Xcode-related directories, propagated through Xcode build phases and Git-related project artifacts, and in later variants used fileless persistence via macOS preferences alongside additional mechanisms such as Git hooks, Launch Daemons, shell profile modification, trojanized applications, and Dock-related persistence. XCSSET employs multilayer obfuscation, polymorphic or frequently recompiled payloads, dynamic in-memory execution, and encrypted command-and-control communications, including RC4 in earlier reporting and stronger per-build encryption schemes in later variants. It also performs reconnaissance and environment checks, including host locale queries, firewall configuration inspection, System Integrity Protection checks, and anti-VM logic in newer versions.
XCSSET has repeatedly been associated with attempts to weaken or bypass macOS security controls. Public reporting has linked it to abuse of a macOS TCC bypass later patched as CVE-2021-30713. Variants have also attempted to interfere with protections such as XProtect, MRT, TCC, Rapid Security Response, and telemetry components. The malware’s tradecraft and victimology make it a significant threat to macOS software developers, especially those working with Xcode-based projects and shared source repositories, with later campaigns showing heightened targeting of developers in South Asia.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
CVE-2021-30713 May 24 macOS TCC bypass abused by XCSSET malware
37 distinct techniques documented for this family, organized by ATT&CK tactic.
the hijacker module enables system command execution via a fileless reverse shell
Take the malicious AppleScript file “telegram.applescript” as an example... Similar scripts can be found targeting the following applications.
Now, it calls the curl command to download a shell script named “a” from the C&C server and passes its contents to “sh” to execute it.
A new module, “canary,” is added to perform XSS injection on the Chrome Canary browser from Google
The user is then prompted to grant these privileges via a fake dialog box.
obfuscating function names, variables, and strings, with build-unique ciphers
using separate encryption keys for inbound and outbound communications
The malware aggressively attempts to disable macOS security such as XProtect, MRT, TCC, and Rapid Security Response, terminates Apple’s CloudTelemetryService, and prevents XProtect signature updates.
deploying 17 separate modules that enable credential theft, keystroke logging, clipboard manipulation, browser hijacking, and data exfiltration
The malware was able to execute session cookie theft, enabling them to impersonate the targeted employee in a remote location
In Chrome, the stolen data includes any passwords stored by the user... Once it has obtained the Chrome safe_storage_key, it decrypts all the sensitive data and uploads it to the C&C server.
The code allows the attackers to intercept web traffic, including credentials, cookies, and MetaMask transactions
It attempts to disrupt updates and security telemetry, lock the XProtect database, and reset automation-permission decisions.
Copy “~/Library/Group Containers/6N38VWS5BX.ru.keepcoder.Telegram” folder from machine A to machine B, and replace the existing folder. Run Telegram on machine B. When this is done, it is already logged in with the same account used on machine A.
The content repeatedly describes malware and threat actors collecting host details such as hostname, OS version, architecture, CPU, memory, BIOS, language, and other machine characteristics; e.g., "Action RAT has the ability to collect the hostname, OS version, and OS architecture of an infected host."
Andariel has collected large numbers of files from compromised network systems for later extraction... APT28 has retrieved internal documents from machines inside victim environments... BADNEWS crawls the victim's local drives and collects documents... many listed groups and malware collect files, documents, credentials, payment card data, or other information from compromised hosts.
deploying 17 separate modules that enable credential theft, keystroke logging, clipboard manipulation, browser hijacking, and data exfiltration
The content is a MITRE ATT&CK-style listing of malware and threat actors that "can capture screenshots," "take screenshots," "perform screen captures," or "watch the victim's screen." It ends with references to "CopyFromScreen" and "xwd."
deploying 17 separate modules that enable credential theft, keystroke logging, clipboard manipulation, browser hijacking, and data exfiltration
The result is a fileless reverse shell running through a legitimate Chrome process... then returns output through the CDP WebSocket connection.
Examples include 'Chaos provides a reverse shell connection on 8338/TCP, encrypted via AES,' 'Winnti for Linux has used a custom TCP protocol with four-byte XOR for command and control,' and 'XCSSET uses RC4 encryption over TCP to communicate with its C2 server.'
The content repeatedly describes malware and threat actors that can "download files from C2," "download additional payloads," "upload and download files," "retrieve payloads from the C2 server," and "copy files to remote machines."
113 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
61 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
XCSSET is a macOS malware family distributed via compromised Xcode projects and Git repositories. In the described campaign, version 40 uses a four-stage infection chain and 17 modules for credential theft, keystroke logging, clipboard manipulation, browser hijacking, data exfiltration, Chrome-based traffic interception, MetaMask transaction manipulation, reverse shell execution, and trojanizing Telegram Desktop, while also attempting to disable multiple macOS security protections.
Advanced macOS malware that targets Apple developers via Xcode supply-chain compromise. It infects legitimate Xcode projects, spreads across existing projects on compromised hosts, uses fileless persistence, dynamic in-memory execution, polymorphic payloads, and multi-layered obfuscation, and supports credential theft, browser hijacking, clipboard monitoring, data exfiltration, and rotating C2 communications.
A macOS-focused malware family that infects poisoned Xcode projects, spreads through other projects, and turns local software builds into supply-chain compromises. The v40 variant uses memory-based execution, polymorphic/encrypted payload changes, short-lived files, persistence via macOS preferences, and a Chrome-hijacking backdoor abusing Chrome DevTools Protocol for cookie theft, web-session monitoring, password-manager autofill capture, crypto-wallet transaction interference, and fileless reverse-shell style command execution.
A macOS malware family that targets developers via Xcode.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.