A Mac malware strain that preys on software developers has returned in a new form that runs mostly from memory. The refreshed build has been circulating since April inside tampered project files for Apple’s Xcode development tool, and its operators have sharpened its stealth and self-spreading behavior.
Security firm Palo Alto Networks Unit 42 tracks the family as XCSSET and labels this release v40. Researchers say the redesign shifts between encrypted forms, leaving few stable files behind for scanners.
Delivery works through supply chain style infection, with a downloader script injected into benign project files hosted in Xcode projects and vulnerable Git repositories. The endpoint compromise only begins when a developer builds that project locally; viewing or cloning a repository does not trigger it. Once on a machine, the malware can infect every Xcode project present.
Researchers mapped 17 modules served from rotating command-and-control infrastructure. Browser hijacking, credential theft, clipboard monitoring, and cryptocurrency theft are all within reach, and a module added in May can trojanize Telegram Desktop. The strain also fights back: it resets AppleEvents consent decisions to re-prompt users while impersonating System Settings or Xcode, interferes with security updates and telemetry, and holds back its main modules when it detects a virtual machine.
Persistence no longer depends on files on disk. Between cycles, v40 stashes a Base64-encoded staging payload inside a randomly named macOS preferences domain, then relaunches from there after reboot. The authors hid the code behind a multi-layered cipher shift that Unit 42 broke with AI.
The campaign has concentrated on developers in South Asia, but the delivery mechanism works anywhere a team imports and builds an infected project. Unit 42 says anyone who has built a suspicious project should treat the Mac as compromised, rotate credentials from a clean device, and rebuild from trusted media.
