Executive Summary
XCSSET v40 represents a significant escalation in macOS threat tradecraft, emerging in early 2026 to target software developers through compromised Xcode projects. By hiding malicious logic in memory and utilizing a multi-layered polymorphic architecture, the attackers have drastically reduced their digital footprint while expanding their targeting of open-source projects on GitHub.
Technical analysis reveals a modular framework capable of browser hijacking via the Chrome DevTools Protocol (CDP), Telegram application trojanization, and systematic disabling of macOS security features like XProtect and SoftwareUpdate. The malware's new architecture utilizes a dual-key encryption scheme and fileless persistence through the macOS defaults system to evade traditional detection methods.
The business impact is severe for organizations with macOS-based development teams, as a single infected workstation can act as a self-propagating vector into the broader software supply chain. The threat is particularly active in South Asia, leveraging a rotating C2 infrastructure aged for months to bypass reputation-based filtering.