New XCSSET macOS Variant: Defending Against Compromised Xcode Projects

Security Arsenal is actively tracking a significant resurgence of the XCSSET malware, specifically engineered to target macOS developers. In this ongoing campaign, threat actors are compromising legitimate Xcode projects and GitHub repositories to distribute a new, stealthy variant of the malware.

Unlike standard phishing, this attack vector abuses the trust developers place in open-source dependencies and shared codebases. By injecting malicious scripts into the build phases of Xcode projects, attackers achieve code execution on the developer's machine simply by compiling the target application. Given the elevated privileges often held by development environments and the access to source code, the risk of supply chain contamination and credential theft is severe. Defenders must immediately assume that any unverified cloned repository could be a delivery mechanism.

Technical Analysis

Target Platform: macOS (Intel and Apple Silicon).

Attack Vector: Compromised Xcode Projects (.xcodeproj) and GitHub repositories.

Mechanism of Action: The attackers modify the PBXShellScriptBuildPhase within the Xcode project file (project.pbxproj). This allows them to insert arbitrary shell scripts that execute automatically during the application build process. This is a "build-chain" attack. When the victim builds the project—often without inspecting the hidden build phases—the embedded script executes.

Post-Exploitation Activity: Once the build script runs, the payload typically performs the following actions:

Payload Injection: Injecting malicious code into existing applications (e.g., Safari or other local binaries) to bypass OS transparency, consent, and controls (TCC).
Data Exfiltration: Harvesting browser cookies and Safari data to compromise session tokens.
Persistence: Installing Launch Agents or Daemons to maintain access after the build process concludes.

Exploitation Status: Confirmed active exploitation in the wild via public GitHub repositories.

Detection & Response

SIGMA Rules

YAML

---
title: Potential XCSSET Activity - Suspicious Xcode Build Script Execution
id: 9a8b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects the execution of shell scripts by xcodebuild, which may indicate a compromised Xcode project running a malicious build phase.
references:
 - https://attack.mitre.org/techniques/T1059/004/
author: Security Arsenal
date: 2026/05/12
tags:
 - attack.execution
 - attack.t1059.004
 - attack.initial_access
 - attack.t1195.002
logsource:
 category: process_creation
 product: macos
detection:
 selection:
   ParentImage|endswith: '/xcodebuild'
   Image|endswith:
     - '/sh'
     - '/bash'
     - '/zsh'
   CommandLine|contains:
     - 'curl'
     - 'python'
     - 'osascript'
     - 'chmod'
 condition: selection
falsepositives:
 - Legitimate build scripts that perform setup or dependency management (e.g., CocoaPods, Carthage). Verify the CommandLine arguments and source repository.
level: high
---
title: Suspicious LaunchAgent Creation from Build Process
id: 1a2b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects xcodebuild or Xcode spawning a process that creates or modifies a LaunchAgent, a common persistence mechanism for macOS malware like XCSSET.
references:
 - https://attack.mitre.org/techniques/T1543/001/
author: Security Arsenal
date: 2026/05/12
tags:
 - attack.persistence
 - attack.t1543.001
logsource:
 category: process_creation
 product: macos
detection:
 selection:
   ParentImage|endswith:
     - '/xcodebuild'
     - '/Xcode'
   Image|endswith:
     - '/launchctl'
     - '/cp'
     - '/mv'
   CommandLine|contains: 'Library/LaunchAgents'
 condition: selection
falsepositives:
 - Rare. Legitimate apps may install helpers, but not typically spawned directly by the compiler process during a build.
level: critical

KQL (Microsoft Sentinel / Defender)

KQL — Microsoft Sentinel / Defender

// Hunt for suspicious child processes spawned by xcodebuild
// Focuses on network activity or script execution during builds
DeviceProcessEvents  
| where InitiatingProcessFileName == "xcodebuild"
| where FileName in ("sh", "bash", "zsh", "python", "curl", "osascript")
| project Timestamp, DeviceName, AccountName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, FolderPath
| order by Timestamp desc

Velociraptor VQL

VQL — Velociraptor

-- Hunt for Xcode build processes spawning suspicious shells or network tools
SELECT Pid, Ppid, Name, Exe, CommandLine, Username
FROM pslist()
WHERE Pid IN (
    SELECT Pid FROM pslist()
    WHERE Name =~ "xcodebuild"
)
   AND Name =~ "(sh|bash|zsh|python|curl|osascript)"
-- Check for LaunchAgent creation/modification
SELECT FullPath, Mtime, Atime, Size, Mode
FROM glob(globs="/*/Library/LaunchAgents/*.plist")
WHERE Mtime > now() - 24h

Remediation Script (Bash)

Bash / Shell

#!/bin/bash
# XCSSET Incident Response Script for macOS
# Usage: sudo ./remediate_xcsset.sh

echo "[*] Starting XCSSET Response Procedures..."

# 1. Kill active xcodebuild processes (caution: stops active builds)
echo "[*] Terminating active xcodebuild processes..."
pkill -9 xcodebuild

# 2. Identify and quarantine user LaunchAgents modified recently (last 7 days)
echo "[*] Checking for suspicious LaunchAgents..."
find /Users/*/Library/LaunchAgents -name "*.plist" -mtime -7 -exec ls -l {} \;

# 3. Check for known XCSSET payload locations (historical context + generic paths)
# Note: In a real incident, hash these files before deletion.
echo "[*] Scanning for common malware persistence locations..."
if [ -d "/Users/Shared/.cached" ]; then
    echo "[!] Suspicious directory found: /Users/Shared/.cached"
fi

# 4. Alert user to verify Git repositories
echo "[!] ACTION REQUIRED: Review all recently cloned GitHub repositories."
echo "[!] Run the following command in your project directories to inspect build scripts:"
echo "    grep -r 'shellScript' .xcodeproj/project.pbxproj"

echo "[*] Remediation script complete. Please perform a full endpoint scan."

Remediation

Isolate Affected Systems: Immediately disconnect infected macOS endpoints from the network and cloud repositories to prevent the malware from exfiltrating credentials or pushing malicious code to internal repositories.
Audit Build Configurations: Developers must audit their local .xcodeproj/project.pbxproj files for any shellScript entries that are not recognized. Inspect all Run Script build phases in Xcode (Navigate to Target > Build Phases).
Source Code Verification: Verify the integrity of local code against the remote repository. If a repository was compromised, assume the local working copy is tainted. Delete the local directory and re-clone from a known clean commit (verify commit hashes via a separate, secure channel).
Credential Rotation: Since XCSSET variants typically target browser cookies and keychains, treat all session cookies and saved passwords in the browser as compromised. Force password rotation for critical accounts (GitHub, AWS, Azure, internal CI/CD tools).
Re-image the Endpoint: Given the sophisticated nature of macOS malware and the potential for rootkit-style injections, the safest remediation is a full wipe and re-provisioning of the macOS device.

Related Resources

Security Arsenal Incident Response Services AlertMonitor Platform Book a SOC Assessment incident-response Intel Hub