New XCSSET Variant Targets macOS Developers via Compromised Xcode Projects

According to BleepingComputer, a new version of the XCSSET malware has been observed targeting macOS users through compromised Xcode projects and GitHub repositories, reportedly affecting thousands of users. XCSSET is a known macOS malware family that has historically spread by infecting Xcode projects, so that any developer who builds or opens a trojanized project inadvertently executes the malicious payload.

Why It Matters

This campaign specifically targets software developers, a high-value population with access to source code, build systems, credentials, and signing infrastructure. A compromise at this stage of the software supply chain can propagate malicious code downstream into shared repositories or shipped products, and infected developer machines may also expose CI/CD secrets, cloud credentials, or code-signing material.

What Defenders Should Watch For

• Treat third-party or forked Xcode projects, especially those pulled from public GitHub repositories, as untrusted until reviewed — inspect build phases, run scripts, and project configuration files (.pbxproj) for unexpected shell commands.
• Monitor for unusual child processes spawned by Xcode or xcodebuild during project builds, particularly shell interpreters, curl/wget-style network calls, or persistence mechanisms such as new LaunchAgents/LaunchDaemons.
• Watch for anomalous outbound network connections originating from developer workstations shortly after opening or building a new Xcode project.
• Review macOS TCC/permission prompts granted to Xcode or related tooling, and audit developer endpoints for unexpected keychain or browser-data access, a behavior historically associated with XCSSET.
• Encourage developers to verify the provenance of Xcode projects before building them and to build untrusted projects in isolated or sandboxed environments where feasible.

This is developing intelligence based on a single external report, and full technical details, indicators of compromise, and scope of impact were not available at the time of writing. For the latest details, see the original report from BleepingComputer.