Back Morningstar

ADEX Publishes Analysis of XCSSET Malware: Research Details How Active Infection ...

Morningstar • May 19, 2026

LIMASSOL, Cyprus , May 19, 2026 /PRNewswire/ -- The ADEX security team has released a detailed technical case study documenting a live XCSSET infection detected, captured, and analyzed within a client environment – an iOS app development studio whose infrastructure was suspected to be compromised.

XCSSET is a modular macOS malware family first identified in 2020 that has continued to evolve, with new injection methods documented as recently as 2025 by Microsoft. Unlike conventional malware, XCSSET does not reside in compiled applications. Instead, it embeds itself inside Xcode project files and executes the moment a developer initiates a build – with no unusual permissions, no suspicious downloads, and no alerts from the operating system.

Key findings from the ADEX investigation include:

The ADEX team captured the live sample using a 100-millisecond polling loop after observing repeated short-lived osascript processes spawning from the /tmp directory – a behavioral pattern that served as the initial indicator of compromise. The sample was identified as a compiled AppleScript binary containing an obfuscated, base64-encoded payload.

The full case study is available at ADEX blog.

Media Michael Gor 97767567 [email protected]

View original content:

The articles, information, and content displayed on this webpage may include materials prepared and provided by third parties. Such third-party content is offered for informational purposes only and is not endorsed, reviewed, or verified by Morningstar.

Morningstar makes no representations or warranties regarding the accuracy, completeness, timeliness, or reliability of any third-party content displayed on this site. The views and opinions expressed in third-party content are those of the respective authors and do not necessarily reflect the views of Morningstar, its affiliates, or employees.

Morningstar is not responsible for any errors, omissions, or delays in this content, nor for any actions taken in reliance thereon. Users are advised to exercise their own judgment and seek independent financial advice before making any decisions based on such content. The third-party providers of this content are not affiliated with Morningstar, and their inclusion on this site does not imply any form of partnership, agency, or endorsement.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

XCSSET Malware Targets macOS Developers Through Xcode Projects The ADEX security team has published a case study on an active XCSSET malware infection affecting an iOS app development studio. XCSSET, a modular macOS malware identified in 2020, embeds itself in Xcode project files and executes during the build process without alerting the developer. This malware is capable of stealing credentials from various sources, including browsers and cryptocurrency wallets, and can propagate itself by injecting into other Xcode projects. The infection is particularly dangerous as it operates silently, inheriting the developer's permissions. The ADEX team captured the malware using a behavioral analysis technique, revealing its complex capabilities, including clipboard hijacking and ransomware functionality. The malware's evolution continues, with new methods documented as recently as 2025. The case study emphasizes the need for heightened security awareness among developers. 3 sources 70

Extracted Entities

ADEX Publishes Analysis of XCSSET Malware: Research Details How Active Infection ...

The full story

Extracted Entities

Attack Types (1)

Email Addresses (1)

Malware (1)

MITRE ATT&CK (3)

Platforms (2)

Tools (1)