XCSSET Malware Evolves with Enhanced Obfuscation and Persistence Techniques

The XCSSET malware has released a new variant, v40, targeting macOS systems and specifically infecting Xcode projects. This version employs advanced obfuscation techniques, including polymorphic payload generation and fileless persistence, significantly reducing its digital footprint. The malware has spread through supply chain attacks, embedding itself in legitimate applications' Xcode projects, affecting thousands of users. Notably, it can now infect all existing Xcode projects on a compromised system, enhancing its worming capabilities. Microsoft and Palo Alto Networks have documented its evolution, highlighting its sophisticated encryption and command-and-control mechanisms. The malware's capabilities include clipboard hijacking and expanded data exfiltration, particularly targeting digital wallet information. As of now, the malware is actively being observed in the wild, with ongoing attacks reported since early April 2026. Security measures and mitigation strategies are being shared by researchers to combat this evolving threat.

Key Points: • XCSSET v40 targets macOS and infects Xcode projects, affecting thousands of developers. • The malware employs advanced obfuscation and fileless persistence techniques for stealth. • Ongoing attacks have been reported since April 2026, with new capabilities for data exfiltration.