Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

The Xcode Assassin Returns: A Deep Dive Into the Latest XCSSET Version

Summary: After months of dormancy, the attackers behind the XCSSET malware released version 40, which hides its core logic in memory and spreads through supply chain attacks by embedding itself in the Xcode projects of dozens of legitimate applications with thousands of active users since early April 2026. Unit 42's analysis found 17 distinct modules delivered via a dynamic C2 infrastructure, including a new Chrome hijacking backdoor that misuses the Chromium DevTools Protocol and a Telegram Desktop trojanizer introduced in May 2026.

Bottom line: The malware only triggers when a developer builds an infected project locally, and it can now infect every existing Xcode project on a compromised system - so a single build on one developer's machine can seed your entire codebase.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Detection & Response
Related
YARA-X 1.23.0 Release, (Sun, Nov 15th) Cyber Risks · Nov 15, 2026