XCSSET Malware Returns With Chrome Hijacker and Fake Telegram App, Hitting Mac Developers

Key points

• Palo Alto Networks' Unit 42 identified XCSSET version 40 in two attack waves during mid-April and early May 2025.
• The malware spreads through booby-trapped Xcode projects on GitHub and infects Macs when developers build the code.
• Version 40 adds a Chrome browser hijacker that can steal logins and reroute MetaMask cryptocurrency transactions.
• A second new module deletes the real Telegram Desktop app and swaps in a malicious copy.
• XCSSET has been active against macOS since at least 2021 and now runs 17 modules for theft, keylogging and data exfiltration.

A fresh version of a long-running Mac malware family called XCSSET is doing the rounds again, and this time it is aimed squarely at software developers.

Researchers at Palo Alto Networks' Unit 42 say the new build, tracked as version 40, has been used in two waves of attacks: one in mid-April and another in early May. It was first reported by BleepingComputer.

The malware spreads in an unusually sneaky way. Attackers slip a hidden downloader script into Xcode projects, Apple's free toolkit for building Mac and iPhone apps, and push those projects to GitHub. When a developer downloads the project and hits build, their Mac is infected. The infection then spreads to every other Xcode project on the machine, so any code that developer later shares carries the malware onward.

What does the new version actually do?

It steals things and rewires the browser. Version 40 keeps XCSSET's older tricks and bolts on two new modules: a Chrome hijacker and a fake Telegram app.

The Chrome module wraps the real Chrome browser in a malicious launcher. It quietly switches on the Chrome DevTools Protocol, a built-in developer feature that lets outside code inspect and control the browser, on a local port. From there it pulls JavaScript from the attackers' server and injects it into pages the victim visits.

That gives the criminals a live view of web traffic. They can grab passwords and session cookies. They can also alter MetaMask cryptocurrency transactions on the fly, meaning a victim who thinks they are sending funds to one wallet can have the payment quietly redirected. The same module opens a fileless reverse shell, a hidden channel that lets the attacker run system commands without dropping a file on disk. Google already blocks this trick in Chrome on Windows and is working to extend the same protection to macOS.

The second new piece is a Telegram trojanizer. It deletes the genuine Telegram Desktop app and replaces it with a tampered copy, presumably to read the victim's messages. Unit 42 could not crack its encrypted configuration, so the full feature set is still unknown.

How did it get past macOS defences?

By attacking them directly. XCSSET tries to disable XProtect (Apple's built-in antivirus), the Malware Removal Tool, Transparency Consent and Control (which governs app permissions), and Rapid Security Response updates. It also kills Apple's CloudTelemetryService and blocks XProtect signature updates so Apple cannot push a fix.

The operators have hardened the malware itself, too. The loader is recompiled on the server periodically, inbound and outbound traffic use separate encryption keys, and function names, variables and strings are scrambled with a fresh cipher per build.

Timeline and scope

What should Mac developers do now?

Treat any Xcode project pulled from an unfamiliar GitHub repo as suspect until reviewed. Scan open-source dependencies before they enter your build pipeline. Watch for odd AppleScript activity, unexpected changes to Chrome, and apps signed ad hoc that slip past Gatekeeper, Apple's app-vetting layer.

For everyone else: if you use MetaMask on a Mac shared with a developer, double-check destination wallet addresses out-of-band before signing any transaction. And if Telegram Desktop starts behaving oddly, reinstall it from the official source.