Adex Publishes Analysis Of Xcsset Malware Research Details How Active Infection Spreads Silently Through Xcode Projects Github Repositories And Developer Credentials 302775907

www.prnewswire.com • May 19, 2026

LIMASSOL, Cyprus , May 19, 2026 /PRNewswire/ -- The ADEX security team has released a detailed technical case study documenting a live XCSSET infection detected, captured, and analyzed within a client environment – an iOS app development studio whose infrastructure was suspected to be compromised.

XCSSET is a modular macOS malware family first identified in 2020 that has continued to evolve, with new injection methods documented as recently as 2025 by Microsoft. Unlike conventional malware, XCSSET does not reside in compiled applications. Instead, it embeds itself inside Xcode project files and executes the moment a developer initiates a build – with no unusual permissions, no suspicious downloads, and no alerts from the operating system.

Key findings from the ADEX investigation include:

The ADEX team captured the live sample using a 100-millisecond polling loop after observing repeated short-lived osascript processes spawning from the /tmp directory – a behavioral pattern that served as the initial indicator of compromise. The sample was identified as a compiled AppleScript binary containing an obfuscated, base64-encoded payload.

The full case study is available at ADEX blog.

Media Michael Gor 97767567 [email protected]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

XCSSET Malware Targets macOS Developers Through Xcode Projects The ADEX security team has published a case study on an active XCSSET malware infection affecting an iOS app development studio. XCSSET, a modular macOS malware identified in 2020, embeds itself in Xcode project files and executes during the build process without alerting the developer. This malware is capable of stealing credentials from various sources, including browsers and cryptocurrency wallets, and can propagate itself by injecting into other Xcode projects. The infection is particularly dangerous as it operates silently, inheriting the developer's permissions. The ADEX team captured the malware using a behavioral analysis technique, revealing its complex capabilities, including clipboard hijacking and ransomware functionality. The malware's evolution continues, with new methods documented as recently as 2025. The case study emphasizes the need for heightened security awareness among developers. 3 sources 70

Extracted Entities

Adex Publishes Analysis Of Xcsset Malware Research Details How Active Infection Spreads Silently Through Xcode Projects Github Repositories And Developer Credentials 302775907

The full story

Extracted Entities

Attack Types (1)

Countries (1)

Malware (1)

MITRE ATT&CK (1)

Platforms (3)

Tools (1)