The Xcode Assassin Returns A Deep Dive Into the Latest XCSSE...

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://unit42.paloaltonetworks.com/xcsset-v40-malware-analysis
• Blog Title: The Xcode Assassin Returns: A Deep Dive Into the Latest XCSSET Version
• Suggested Section: macOS Hardening > macOS Process Abuse > macOS Chromium Injection, with cross-references from macOS Auto Start, macOS TCC Bypasses, macOS Defensive Apps, and a developer supply-chain/Xcode build-phase abuse subsection

🎯 Content Summary

Overview

XCSSET v40 is a modular macOS malware framework targeting software developers through poisoned Xcode projects, Git repositories and open-source supply chains. Unit 42 began tracking this version in mid-April 2026 and observed a second deployment wave in early May 2026, when the operators added more modules, including a Telegram Desktop trojanizer. Since early April 2026, infected Xcode projects belonging to dozens of legitimate applications with thousands of active users have...

🔧 Technical Details

Developer-project infection and supply-chain propagation: A malicious Xcode run-script phase can turn a trusted source project into an execution vector because the script runs when a developer builds the project. A modular infector can subsequently modify other local Xcode projects, install Git pre-commit hooks and unpack, modify and repack projects found in ZIP archives. This creates a worm-like chain in which compromised developer workstations and repositories distribute the downloader to additional developers.

Temporary staging followed by in-memory module execution: A short-lived shell stage can fingerprint the endpoint, download a loader into a temporary path, dynamically compile an AppleScript wrapper and use osascript to fetch and execute encrypted modules. Once the memory-resident dispatcher is active, deleting the loader and temporary application reduces the disk footprint while the dispatcher continues retrieving task-sp...

🤖 Agent Actions

Using repo-inspection first to find the best existing macOS/Xcode/browser page to update.
I found the local shell tool and will inspect the repo and existing macOS/browser/Xcode coverage before choosing one file.
Next I’m reading several existing macOS pages to match HackTricks style and check whether these techniques are already covered.
I’ve narrowed likely targets; now I’m checking the existing Chromium injection page plus related persistence/TCC pages for overlap and gaps.
I found the existing Chromium injection page already covers generic CDP abuse, so I’m now checking whether the Xcode build-phase / defaults-persistence / TCC-reset details already exist elsewhere before deciding what’s still missing.
I’m doing a final duplication check for Xcode build-phase abuse, defaults-backed persistence, and TCC prompt recycling before editing a single page.
I’ve selected the existing Chromium injection page and am adding only the missing Xcode delivery, wrapper-based CDP backdoor, and hunting guidance there.
I’ve made the edit; now I’m verifying the diff and that only the intended HackTricks file changed.
Updated 1 file:

• src/macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-chromium-injection.md

What I added:

• Xcode Run Script / poisoned project delivery context for Chromium abuse
• Wrapper-based Chrome relaunch pattern used by XCSSET-like malware
• CDP pre-document injection via Page.addScriptToEvaluateOnNewDocument
• Browser-to-host command bridge via Runtime.consoleAPICalled
• Detection/hunting guidance for developer endpoints
• References to the Unit 42 article and official CDP docs

I kept it to a single existing file and verified no other files changed.

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://unit42.paloaltonetworks.com/xcsset-v40-malware-analysis

Content Categories: Based on the analysis, this content was categorized under "macOS Hardening > macOS Process Abuse > macOS Chromium Injection, with cross-references from macOS Auto Start, macOS TCC Bypasses, macOS Defensive Apps, and a developer supply-chain/Xcode build-phase abuse subsection".

Repository Maintenance:

• MD Files Formatting: 990 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0