XCSSET Malware Targets macOS Developers Through Xcode Projects

The ADEX security team has published a case study on an active XCSSET malware infection affecting an iOS app development studio. XCSSET, a modular macOS malware identified in 2020, embeds itself in Xcode project files and executes during the build process without alerting the developer. This malware is capable of stealing credentials from various sources, including browsers and cryptocurrency wallets, and can propagate itself by injecting into other Xcode projects. The infection is particularly dangerous as it operates silently, inheriting the developer's permissions. The ADEX team captured the malware using a behavioral analysis technique, revealing its complex capabilities, including clipboard hijacking and ransomware functionality. The malware's evolution continues, with new methods documented as recently as 2025. The case study emphasizes the need for heightened security awareness among developers.

Key Points: • XCSSET malware infects Xcode projects, executing during the build process. • The malware steals sensitive credentials and can propagate to other projects automatically. • ADEX's analysis highlights the silent nature of the infection and its advanced capabilities.