Affected Systems

macOS developers using Xcode and downloading projects from compromised Git/GitHub repositories. XCSSET v40 observed in attacks mid-April and early May 2026. All macOS versions with Xcode are at risk; specific version details not provided.

Exploitation Status

Active exploitation confirmed. Palo Alto Unit 42 observed two distinct attack waves in mid-April and early May 2026. Malware spreads via supply chain compromise of Xcode projects hosted on vulnerable Git repositories.

Business Impact

Developers building compromised Xcode projects infect their local environment, which then propagates to all other Xcode projects on the system and shared source code repositories. XCSSET deploys 17 modules enabling credential theft, keylogging, clipboard manipulation, browser hijacking (Chrome), data exfiltration, and cryptocurrency theft (MetaMask interception). New Chrome hijacker enables fileless reverse shell and real-time web traffic manipulation. Telegram Desktop replacement allows communication interception. Malware disables macOS security features including XProtect, MRT, TCC, Rapid Security Response, and blocks signature updates. High risk of supply chain contamination across development teams.

Urgency

🟠 Within 24 hours

Recommended Actions

  • Audit all Xcode projects for unexpected build scripts or downloader components, especially in recently cloned or updated repositories from GitHub or other Git sources
  • Scan macOS developer workstations for ad hoc-signed applications bypassing Gatekeeper, unauthorized Chrome browser modifications, and suspicious AppleScript activity
  • Implement repository integrity checks and dependency scanning tools to detect compromised open-source dependencies before they enter development pipelines
  • Monitor macOS security service status (XProtect, MRT, TCC, CloudTelemetryService) for unexpected termination or disabled state on developer endpoints
  • Restrict Chrome DevTools Protocol (CDP) access on local ports and review browser extensions or wrappers on macOS developer machines for unauthorized modifications