XCSSET v40: From Xcode Supply Chain to Memory-Resident and Browser/Telegram Hijacking
1. Basic Information
- Article Title: The Xcode Assassin Returns: A Deep Dive Into the Latest XCSSET Version
- Publisher: Unit 42
- Publication Date: 2026-07-31
- Severity: High
- Original Source: https://unit42.paloaltonetworks.com/xcsset-v40-malware-analysis/
- Related Malware: XCSSET v40
- Threat Actor: XCSSET operators (Unattributed)
- CVE: None
- Products/Environments: macOS, Xcode, Google Chrome, Telegram
Related Sources
2. Executive Summary
A macOS supply chain attack that starts with building a legitimate Xcode project. After C2 approval, a multi-stage loader executes 17 modules in memory to hijack Chrome sessions and the Telegram app.
3. Attack Flow
Xcode Supply Chain Infection
- Attackers inject a malicious run-script into a legitimate Xcode project on platforms like GitHub.
- A developer builds the project locally and runs the script, which is obfuscated using Hex/Base64.
- The script uses
curlto connect to/aon the C2 server withp=xcode_phase, sending system info likeunameandwhoami. - If the C2 server approves the target, the bash stager checks the serial number and creates
/tmp/rand/or/tmp/p.app. - It uses
osascriptto run the boot orchestrator in memory, then deletes the temporary files and staging processes. - The boot orchestrator downloads encrypted modules from
/s/<encoded_module_name>to steal browser data, log keys, access the clipboard, and exfiltrate information. - It self-replicates into other existing Xcode projects on the infected machine to spread to the next developer and build artifacts.
Chrome/Telegram Hijacking
- It wraps legitimate Chrome in a malicious wrapper to restart the boot orchestrator every time Chrome launches.
- It launches Chrome with CDP (Chrome DevTools Protocol) enabled arguments and a fixed local port.
-
chrome_remoteconnects to CDP to run arbitrary JavaScript, extract cookie tokens, and control existing sessions. - Another module deletes the legitimate
Telegram.app, replaces it with a fake app from a C2 ZIP file, and applies an ad-hoc signature. - It terminates the legitimate process so the user runs the trojanized Telegram when they restart the app.
4. Attacker Positions and Execution Locations
- Attacker Positions: Code supply sources like GitHub, and rotating C2 servers.
- Execution Locations: Developer macOS, Xcode build phases, bash/osascript/Chrome CDP, and the replaced Telegram.app.
- Secondary Spread Points: Other Xcode projects on the infected machine.
5. Visibility for Victims and Administrators
Victims and Users
- Infection happens simply by building a project downloaded as usual, and the finished app may look completely normal.
- If TCC permissions are denied, fake re-prompts may appear, masquerading as System Settings or Xcode.
Administrators and SOCs
-
curl,bash, andosascriptspawned from Xcode, along with short-lived creation of/tmp/rand/tmp/p.app. - Chrome remote-debugging/CDP arguments and unusual launcher paths.
- Random domains/keys added to
defaults, Perl processes holding XProtect XPdb, and termination ofCloudTelemetryService.
6. Success and Failure Conditions
Success Conditions
- An Xcode project containing a malicious run-script is built.
- The machine reaches the C2 server, and the C2 approves the host profile.
- Standard tools like
osascript,curl, anddefaultsare allowed to run. - The user grants (or has already granted) necessary TCC/AppleEvents permissions.
Failure Conditions
- Code and dependency checks before building detect the run-script.
- C2 domains, IPs, or SSL fingerprints are blocked by DNS or egress filters.
- EDR stops Xcode child processes or CDP enablement.
- The machine is detected as a VM (additional modules will not be downloaded).
- The user denies TCC re-prompts and isolates the device.
7. What Happens on Success
- Theft of Chrome cookie tokens and logged-in sessions.
- Persistent replacement of the Telegram app and establishment of a foothold inside the app.
- Collection and exfiltration of credentials, clipboard data, keystrokes, browser extensions, and local files.
- Supply chain expansion via reinfection of local Xcode projects.
- Interference with SoftwareUpdate, XProtect, CloudTelemetry, and TCC to delay detection and remediation.
8. Observable Logs
- No direct email vector. Subsequent email activity using stolen sessions is inferred.
Proxy/SWG/DNS
- HTTPS requests to
/a,/s/<encoded_module_name>,/w?<cmd>, and/e, connections to enumerated.ru/.inC2 servers, and rapidly changing encrypted blobs.
Endpoint/EDR
- Xcode spawning
sh/bash/curl/osascript, creation of/tmp/rand/tmp/p.app,boot,chrome_remote,defaults write/read,tccutil reset AppleEvents, Perl holding XPdb locks, and termination ofCloudTelemetryService.
Identity/IdP
- Reuse of Chrome cookies and access to existing sessions from unusual devices or User-Agents.
SaaS/Cloud
- Suspicious commits to GitHub repositories, use of compromised developer tokens, and abnormal Telegram data/session activity.
Network
- C2 IP addresses, shared SSL thumbprint
6e480d648fa1b70612f5d198a66875e28847547d, and Chrome local CDP ports.
9. Attack Success Stages
- Contact Only: Viewing or cloning a malicious repository without building.
- User Action: Building the infected project.
-
Initial Execution:
curlto/afrom an Xcode child process and execution of the stager. -
Malware Success:
bootruns and fetches modules from/s/. - Information Theft & Session Compromise: Exfiltration of cookies/clipboard/Telegram data, and use of stolen cookies.
- Secondary Compromise: Tampering with other projects, external commits, and continuous execution of the trojanized app.
10. Investigation Playbook
-
Trigger: Xcode spawning
curl/osascript, Chrome CDP, XCSSET C2/SSL fingerprints. - Initial Verification: Isolate the clone source, commit SHA, build time, and parent-child process/network connections.
-
Endpoint Analysis: Collect
/tmpremnants,defaultsdomains, LaunchDaemons, Git hooks, replaced Chrome/Telegram apps, ad-hoc signatures, and TCC history. - Identity & Cloud: Revoke GitHub PAT/SSH keys, browser sessions, and Telegram sessions, and audit commits by the same developer.
- Secondary Actions: Rescan all Xcode projects and build artifacts, and search enterprise-wide for the same C2 communications.
- Containment: Isolate macOS devices, revoke tokens, block C2 servers, rebuild from trusted media, and remove tainted commits.
- Severity Levels: Exposure / Build Executed / Loader Confirmed / Module Execution / Session Theft / Supply-chain Propagation
11. Defense and Detection Ideas
-
Single Indicators: Xcode spawning
curl,tccutil reset AppleEvents, Chrome remote-debugging, and high-entropy payloads indefaults. -
Correlated Indicators: Project build ->
/abeacon ->/tmpapplet ->osascript-> deletion of temporary items -> module fetch. -
Threat Hunting: Replaced Chrome launchers, Telegram.app hash/signature mismatches, Git hooks, unusual
defaultsdomains, and failed XProtect updates. - Log Gaps: macOS process command lines, ESF/file events, DNS/TLS data, Git audits, and browser/IdP session telemetry.
- Priority Countermeasures: Locking and signing development dependencies, reviewing Xcode run-scripts, installing EDR on developer Macs, shortening token lifespans, and enforcing egress controls.
12. Facts, Inferences, and Hypotheses
Facts
- Attacks via Xcode projects of legitimate apps have been observed since April 2026.
- Version 40 uses a 4-stage loader to run
bootand 17 modules primarily in memory. - Eight different loader hashes were delivered to a single endpoint within 24 hours.
- Abuse of Chrome CDP and replacement of
Telegram.appwere confirmed. - Fileless reinfection via
defaults, interference with XProtect/Telemetry/TCC, and anti-VM checks were confirmed.
Inferences
- Engineering organizations using external open-source or contractor projects face similar risks regarding supply chain infection.
- Combining build-derived process chains and C2 URIs provides more stable detection than relying on hashes alone.
Hypotheses
- If a compromised developer's signing credentials or CI tokens are stolen, the attack could spread to legitimately signed build artifacts, though this has not been confirmed in this case.
13. MITRE ATT&CK Mapping
- T1195.002 – Compromise Software Supply Chain (Confidence: High)
- T1059.004 – Unix Shell (Confidence: High)
- T1059.002 – AppleScript (Confidence: High)
- T1027 – Obfuscated/Compressed Files and Information (Confidence: High)
- T1546.004 – Unix Shell Configuration Modification / Git hook persistence equivalent (Confidence: Medium)
- T1555.003 – Credentials from Web Browsers (Confidence: High)
- T1562.001 – Impair Defenses (Confidence: High)
- T1105 – Ingress Tool Transfer (Confidence: High)
- T1041 – Exfiltration Over C2 Channel (Confidence: High)
14. Open Questions and Further Investigation
- Initial repository tampering vectors and a complete list of affected projects.
- Full features of the replaced Telegram version and contents of
~/.trsettings. - Whether infections have occurred globally.
- Actual instances of stolen cookie usage.
- The extent of contamination spreading from infected projects to distributed artifacts.
15. Impact on SOCs and Organizations
This threat directly affects Apple developers, game studios, fintech/payment apps, and outsourced software development companies. Because developer workstations hold GitHub tokens, signing keys, and cloud credentials, a single endpoint infection must be treated as a supply chain incident. Organizations must investigate not only the workstation but also repositories, CI/CD pipelines, and distributed artifacts.
16. Summaries by Target Audience
For SOCs
Correlate Xcode-initiated curl/osascript, Chrome CDP, defaults persistence, and C2 SSL fingerprints chronologically, without relying on rotating hashes.
For Administrators
Isolate developer Macs and inspect projects, Git history, code signatures, and tokens. Fix upstream sources to prevent reinfection from tainted repositories even after rebuilding the OS.
For Users
Even Xcode projects from seemingly legitimate sources can infect your machine during the build process. Do not approve unexpected AppleEvents permission requests or sudden Chrome/Telegram restarts; report them immediately.
Top comments (0)