A highly evasive malware strain known as XCSSET v40 is actively weaponizing compromised Xcode projects to hijack Google Chrome and replace the macOS Telegram app with a malicious clone. Operating almost entirely from volatile memory, this supply chain attack turns legitimate developer workstations into silent distribution hubs.
For macOS developers and enterprise security teams, this campaign represents a critical escalation in defense evasion. By actively sabotaging built-in Apple security tools like XProtect, the malware ensures its polymorphic payloads remain undetected while exfiltrating sensitive data and intercepting browser traffic.
The Four-Phase Memory-Resident Infection
Active since early April 2026, the actors behind XCSSET have resurfaced with a major re-architecture of their long-running macOS framework. The infection begins when a developer builds a compromised Xcode project or GitHub repository locally. A hidden loader script executes under the developer's own context, inheriting broad system access without triggering conventional permission prompts.
According to threat intelligence from Unit 42, the execution follows a four-phase pipeline. An initial loader establishes command-and-control (C2) communication, fingerprints the host, and drops a temporary staging applet. This applet loads the core logic directly into memory, terminates itself, and immediately deletes all installation artifacts from the disk to drastically reduce forensic visibility.
Weaponizing Chrome DevTools and Trojanizing Telegram
Once the memory-resident core module is active, it dynamically loads task-specific payloads. The Chrome hijacking backdoor repurposes the legitimate Chrome DevTools Protocol (CDP) to control the browser. It wraps the Google Chrome binary in a malicious persistence script, enabling CDP on a local port and spawning a dedicated backdoor that connects to the C2 over WebSocket.
This CDP integration allows attackers to inject JavaScript in real-time, intercept traffic via window.fetch and XMLHttpRequest hooks, steal credentials through autofill manipulation, and interfere with crypto wallets. The Telegram module is equally aggressive. Instead of merely exfiltrating data, the malware downloads a malicious Telegram archive, wipes the legitimate installation, and drops a C2-controlled replacement.
The malware then performs ad hoc code signing and kills the original process, forcing victims to transparently relaunch the trojanized client. Configuration data for this module is delivered via AES-encrypted blobs from dedicated endpoints, maintaining host-level awareness of Telegram artifacts.
Aggressive Evasion and Obfuscation Tactics
XCSSET v40 utilizes an overlapping obfuscation framework spanning binaries, network payloads, and source code. Streaming modules are encrypted with AES-256-CBC per build, utilizing a new initialization vector (IV) for each transmission so identical modules never share ciphertext signatures. Network communications adopt a dual-key architecture, embedding the inbound key within compiled AppleScript.
Internally, string literals are encoded via a keyed Caesar cipher with randomized alphabets. On the host system, the malware aggressively sabotages macOS security. It disables SoftwareUpdate channels to block XProtect, MRT, and TCC database updates. Furthermore, it holds exclusive locks on XProtect YARA signature files to prevent new rules from being written and interferes with the CloudTelemetryService to stop telemetry samples.
Actionable Defense and Known IOCs
Security researchers note that the operators weakened their operational security by reusing SSL certificates, SSH keys, and RDP thumbprints across campaigns. Organizations can detect and block XCSSET v40 behaviors using AI-driven behavioral analytics platforms like Cortex XDR and XSIAM, alongside Advanced URL Filtering and Advanced DNS Security.
| Type | Value | Notes |
|---|---|---|
| C2 | hxxps[:]//amzndev[.]in/d/zw_sfp64 | Chrome CDP helper binary C2 |
| C2 | hxxps[:]//amzndev[.]ru/d/zw_sfp64 | Chrome CDP helper binary C2 |
| C2 | hxxps[:]//googlenets[.]ru/d/zw_sfp64 | Chrome CDP helper binary C2 |
| C2 | hxxps[:]//netcdndev[.]in/d/zw_sfp64 | Chrome CDP helper binary C2 |
| C2 | hxxps[:]//whitead[.]in/d/zw_sfp64 | Chrome CDP helper binary C2 |
| C2 | hxxps[:]//whiteads[.]ru/d/zw_sfp64 | Chrome CDP helper binary C2 |
The Escalation of macOS Rootkit Tactics
The most alarming aspect of XCSSET v40 is not its ability to hijack Chrome or Telegram, but its systematic dismantling of native macOS defenses. By placing exclusive locks on XProtect YARA signature files and blinding the CloudTelemetryService, the threat actors are applying Windows-style rootkit aggression to the Apple ecosystem. This indicates that macOS malware has moved past simple data exfiltration and is now engineered for prolonged, uncontested occupation.
Furthermore, the decision to target developers via Xcode projects creates a devastating multiplier effect. A single infected developer workstation can inadvertently package the malware into legitimate applications, transforming trusted software into downstream infection vectors. This campaign underscores the urgent need for memory-scanning capabilities and zero-trust architecture within macOS development environments, as traditional file-based antivirus solutions are entirely blind to this fileless execution chain.
