XCSSET v40 Abuses Chrome DevTools Protocol to Steal Cookies and Run Commands

Cybersecuritynews •Tushar Subhra Dutta • August 3, 2026

XCSSET has returned with a way to target macOS developers. The latest version, v40, hides inside poisoned Xcode projects and can turn a local build into a supply-chain compromise. Once activated, it can spread through other projects, raising risk for developers and the organizations that use their code. The malware family was first documented in […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

XCSSET v40 Targets macOS Developers via Poisoned Xcode Projects XCSSET v40 has emerged as a significant threat to macOS developers, utilizing poisoned Xcode projects to compromise local builds and execute supply chain attacks. This version can hijack Chrome and Trojanize Telegram while operating primarily from memory, employing aggressive polymorphism to evade detection. The malware can steal cookies and execute commands via the Chrome DevTools Protocol, posing a risk not only to individual developers but also to organizations that rely on their code. The resurgence of XCSSET comes after several months of inactivity, indicating a potential shift in tactics by its operators. Developers are urged to remain vigilant as the malware can spread through affected projects, amplifying its impact across the ecosystem. Current status indicates that the malware is active and poses a high risk to macOS systems. 3 sources 70

Extracted Entities

XCSSET v40 Abuses Chrome DevTools Protocol to Steal Cookies and Run Commands

The full story

Extracted Entities

Attack Types (2)

Malware (1)

Platforms (2)

Tools (1)