"Since early April 2026, the malware has spread through supply chain attacks by hiding itself in the Xcode projects of dozens of legitimate applications with thousands of active users." — Palo Alto Networks Unit 42
How XCSSET v40 turns developer workstations into supply-chain launchpads
Unit 42's analysis lays out a four-stage infection chain that begins when a developer builds a poisoned Xcode project locally. A malicious run-script phase executes during the build, decoding nested Hex- and Base64-encoded payloads and calling back to a command-and-control (C2) /a endpoint with basic context (p=xcode_phase). If the C2 approves the host, it returns an obfuscated bash script that performs deeper hardware fingerprinting, compiles an AppleScript wrapper, and stages the primary loader into memory using osascript. After the loader runs, the malware deletes its temporary files and leaves a mostly fileless, memory-resident orchestrator called "boot" to fetch further modules and execute them in volatile memory.
Two notable new operational modules: Chrome hijacking and Telegram trojanizer
XCSSET v40 adds a Chrome hijacking backdoor and a Telegram trojanizer to a catalog of 17 modules. The Chrome module abuses the Chrome DevTools Protocol (CDP) by wrapping the legitimate Chrome binary in a malicious launcher that restarts the orchestrator, launches Chrome with arguments to open CDP on a local port, and drops a chrome_remote binary. That binary maintains a persistent WebSocket to the C2, pulls JavaScript payloads in real time, injects scripts before pages load, overrides window.fetch and XMLHttpRequest to intercept traffic, manipulates MetaMask Ethereum providers to alter wallet addresses or dApp transactions, and captures credentials by overriding autofill fields. The chrome_remote component can also pivot to host-level commands: it watches for specific console.log strings and forwards the stripped payload to the host shell, returning output via the CDP WebSocket to create a fileless reverse shell.
The Telegram trojanizer, first observed in May 2026, downloads a malicious Telegram.app ZIP, deletes the legitimate app, drops the C2-supplied replacement, ad-hoc code-signs the fake app, and kills the original Telegram process so the trojanized copy is relaunched. Its configuration is delivered from a dedicated endpoint (/w?tr), decrypted to ~/.tr with state tracked in ~/.tr_map, and those artifacts are exfiltrated back to the C2 as base_tr_file.txt and base_tr_map.txt.
Polymorphism, dual-key crypto, and fileless persistence to evade defenders
V40’s architecture emphasizes defense evasion. Unit 42 describes a multi-tiered evasion stack that includes multi-layered encryption, polymorphism at multiple levels, a dual-key network encryption scheme, and pre-compilation identifier substitution. The loader binary is recompiled on the C2 every few hours—analysts observed eight distinct hashes from a single endpoint in 24 hours—and functional modules are AES-256-CBC encrypted with per-build keys and randomized IVs. Every string literal in a module uses a per-module keyed Caesar cipher with a randomized 52-character alphabet, and the C2 pre-substitutes function and variable names so the mapping is absent on disk.
For persistence and stealth, v40 abuses macOS's defaults utility as a fileless re-infection cache: Base64-encoded staging payloads are written into per-host preferences domains under seemingly random keys and decoded on trigger, enabling re-arm without leaving predictable disk artifacts. The malware also actively impairs security mechanisms: it disables the SoftwareUpdate configuration channel, blocks CloudTelemetryService, locks the XProtect signature database (XPdb) with an exclusive file lock via a spawned Perl process, and resets TCC AppleEvents decisions to prompt victims again under false pretenses.
C2 infrastructure, domain strategy, and OPSEC failures
Unit 42 mapped a distinct C2 URI structure and a domain-registration strategy of roughly 40 domains registered in short bursts across a small pool of IPs. The 2026 wave introduced [.in] names registered alongside [.ru] siblings; this geographic pivot aligns with the observed targeting of developers in South Asia. Unit 42 published a sampled domain list that includes names such as amzndev[.]in, googlenets[.]ru, whitead[.]in and many others, and C2 download URLs like hxxps[:]//amzndev[.]in/d/zw_sfp64.
The operators left operational errors that aided attribution and tracking: several domains shared hosting IPs (examples include 91.108.106[.]229 and 95.142.35[.]34 among others), a single SSL thumbprint (6e480d648fa1b70612f5d198a66875e28847547d) was reused, SSH keys were reused, and the same self-signed RDP certificate appeared across infrastructure.
What this means for developers, security teams, and open‑source maintainers
- Security teams and technologists: Watch for fileless, in-memory AppleScript and osascript activity, abnormal defaults domain creation and modification, and polymorphic loader behavior; Unit 42 recommends AI-enhanced process anomaly detection and behavioral enforcement, plus blocking suspicious osascript calls and multi-pass decoders.
- Developers and open-source maintainers: Protect supply-chain touchpoints—Unit 42 urges automated dependency scanning to detect poisoned repositories and monitoring of Xcode build phases for unauthorized run-script additions.
- Enterprises and procurement leaders: Track ad-hoc signed binaries and untrusted local code signers; Unit 42 recommends isolating any binaries that bypass Gatekeeper and monitoring browser launcher paths to prevent unauthorized local replacements.
Unit 42 also notes that Palo Alto Networks products provide protections: Cortex XDR uses Behavioral Threat Protection to block in-memory execution chains and suspicious osascript calls, XSIAM correlates telemetry across repositories and networks, and Advanced URL Filtering and DNS Security block known malicious domains. Unit 42 urges organizations who believe they may be compromised to contact their incident response team.
For the full technical analysis, module mapping and IoCs, see the original Unit 42 report: https://unit42.paloaltonetworks.com/xcsset-v40-malware-analysis/
