XCSSET v40 Infects Xcode Projects to Hijack Chrome and Trojanize Telegram on Macs

Gbhackers •Mayura Kathir • August 3, 2026

XCSSET v40 marks a significant escalation in macOS-focused supply chain attacks, weaponizing poisoned Xcode projects to hijack Chrome and Trojanize Telegram while operating almost entirely from memory with aggressive polymorphism and defense evasion. After several months of apparent inactivity, the actors behind the XCSSET malware resurfaced with version 40 (v40), a major re-architecture of the […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

XCSSET v40 Targets macOS Developers via Poisoned Xcode Projects XCSSET v40 has emerged as a significant threat to macOS developers, utilizing poisoned Xcode projects to compromise local builds and execute supply chain attacks. This version can hijack Chrome and Trojanize Telegram while operating primarily from memory, employing aggressive polymorphism to evade detection. The malware can steal cookies and execute commands via the Chrome DevTools Protocol, posing a risk not only to individual developers but also to organizations that rely on their code. The resurgence of XCSSET comes after several months of inactivity, indicating a potential shift in tactics by its operators. Developers are urged to remain vigilant as the malware can spread through affected projects, amplifying its impact across the ecosystem. Current status indicates that the malware is active and poses a high risk to macOS systems. 3 sources 70

Extracted Entities

XCSSET v40 Infects Xcode Projects to Hijack Chrome and Trojanize Telegram on Macs

The full story

Extracted Entities

Attack Types (2)

Malware (1)

MITRE ATT&CK (1)

Platforms (2)