THE XCODE ASSASSIN RETURNS: A DEEP DIVE INTO THE LATEST XCSSET VERSION

Summary from the TLDR InfoSec newsletter

The latest iteration of the macOS malware XCSSET, version 40, uses supply chain tactics to propagate by hiding malicious run-script phases in legitimate Xcode projects. To maximize stealth, the malware employs a multi-layered polymorphic evasion stack that uses dual-key encryption and in-memory execution, while actively impairing macOS defenses by disabling security updates and locking XProtect signature databases. XCSSET v40 also introduces a novel fileless persistence mechanism that abuses the macOS defaults configuration system, along with new operational modules designed to hijack Google Chrome via the Chrome DevTools Protocol and deploy trojanized Telegram binaries.