XCSSET malware returns in macOS attacks that hijack Chrome

A new version of the XCSSET macOS malware can hijack Google Chrome, intercept browser activity, and turn the browser into a fileless command channel.

The campaign has been spreading through infected Xcode projects since April 2026, targeting software developers and users of the applications they build.

Palo Alto Networks Unit 42 researchers began tracking the new variant, which its operators identify as XCSSET v40, and observed a wave in May that introduced additional operational modules.

began tracking the new variant, identified by its operators as XCSSET v40, and observed a wave in May that added more operational modules.

XCSSET was first documented by Trend Micro in 2020 and primarily targets developers in Apple’s software ecosystem. It spreads by inserting malicious code into Xcode projects and Git repositories, with the infection triggered when a developer builds the compromised project locally.

Unit 42 said the latest XCSSET activity affected dozens of legitimate applications with thousands of active users, with a notable concentration of attacks against developers in South Asia.

The most significant addition is a Chrome hijacking backdoor that abuses the legitimate Chrome DevTools Protocol, or CDP. XCSSET replaces the normal Chrome launch process with a malicious wrapper that restarts the malware’s main orchestrator, opens Chrome with remote debugging enabled on a local port, and launches a component called chrome_remote.

That component connects to Chrome through CDP and maintains a WebSocket connection with the attackers’ command-and-control server. It can inject JavaScript before pages load, allowing the malware to monitor network requests, capture credentials and API tokens, interfere with password-manager autofill, and manipulate cryptocurrency transactions involving MetaMask.

The backdoor can also execute system commands outside the browser. Attackers can send specially formatted console messages through an infected tab, which chrome_remote intercepts and passes to the macOS shell. Command output is then returned through the same WebSocket connection, effectively creating a fileless reverse shell inside a legitimate Chrome process.

Unit 42 said Google has protections against this behavior on Windows and is working to extend similar safeguards to macOS.

XCSSET v40 contains 17 modules, including keylogging, clipboard theft, browser hijacking, and data exfiltration capabilities. A newly added Telegram module can delete the legitimate Telegram Desktop application and replace it with an ad hoc-signed trojanized version supplied by the attackers.

The malware also makes analysis harder by recompiling loaders every few hours, encrypting modules with changing AES keys and initialization vectors, and scrambling internal names and strings. It executes its core components in memory, deletes staging files, and avoids delivering further payloads to systems it identifies as virtual machines.

Developers should monitor Xcode projects and open-source dependencies before building projects from them, investigate Chrome launches using unexpected remote-debugging arguments, and alert on unusual AppleScript, defaults utility, or ad hoc code-signing activity.