--- title: The Xcode Assassin Returns: A Deep Dive Into the Latest... description: Unit 42 researchers have published a deep-dive analysis of XCSSET v40, a new version of the macOS malware family targeting software developers through poisoned... canonical: https://daily.dev/posts/the-xcode-assassin-returns-a-deep-dive-into-the-latest-xcsset-version-0bkaeaifg twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: The Xcode Assassin Returns: A Deep Dive Into the Latest XCSSET Version | daily.dev og:description: Unit 42 researchers have published a deep-dive analysis of XCSSET v40, a new version of the macOS malware family targeting software developers through poisoned... og:url: https://daily.dev/posts/the-xcode-assassin-returns-a-deep-dive-into-the-latest-xcsset-version-0bkaeaifg og:image: https://api.daily.dev/og/posts/0BkaeAIfG.png og:image:alt: The Xcode Assassin Returns: A Deep Dive Into the Latest XCSSET Version og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # The Xcode Assassin Returns: A Deep Dive Into the Latest XCSSET Version **[Unit 42](https://daily.dev/sources/unit42)** · 22 min read · 0 upvotes · 0 comments ## Summary Unit 42 researchers have published a deep-dive analysis of XCSSET v40, a new version of the macOS malware family targeting software developers through poisoned Xcode projects and GitHub repositories. Active since April 2026, v40 introduces significant architectural upgrades including polymorphic payload generation, fileless persistence via the macOS defaults system, a dual-key AES encryption scheme, and two new modules: a Chrome DevTools Protocol (CDP)-based browser backdoor and a Telegram Desktop trojanizer. The malware evades detection by running entirely in memory after infection, locking XProtect signature databases, disabling software update channels, resetting TCC permission databases, and reporting VM environments to the C2 to avoid sandbox analysis. Researchers used AI-assisted pattern matching to break the malware's identifier substitution cipher. The C2 infrastructure spans ~40 domains registered in early 2026 across .ru and .in TLDs, with OPSEC failures including shared SSL thumbprints and reused SSH keys across campaigns. Mitigation strategies include behavioral anomaly detection, supply-chain dependency scanning, and monitoring for abnormal defaults domain creation. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [Microsoft spots XCSSET strain hiding in Apple dev projects](https://daily.dev/posts/microsoft-spots-xcsset-strain-hiding-in-apple-dev-projects-6yzt3jcpq) · The Register · 0 upvotes · 0 comments --- Tags: [#cyber](https://daily.dev/tags/cyber), [#malware](https://daily.dev/tags/malware), [#xcode](https://daily.dev/tags/xcode) [View this post on daily.dev](https://daily.dev/posts/the-xcode-assassin-returns-a-deep-dive-into-the-latest-xcsset-version-0bkaeaifg) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"The Xcode Assassin Returns: A Deep Dive Into the Latest XCSSET Version","url":"https://daily.dev/posts/the-xcode-assassin-returns-a-deep-dive-into-the-latest-xcsset-version-0bkaeaifg","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/the-xcode-assassin-returns-a-deep-dive-into-the-latest-xcsset-version-0bkaeaifg"},"datePublished":"2026-07-31T10:10:53.953Z","dateModified":"2026-08-04T20:15:09.284Z","description":"Unit 42 researchers have published a deep-dive analysis of XCSSET v40, a new version of the macOS malware family targeting software developers through poisoned...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/c4a3298f149ba718809f455b7f2d79c9?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/c4a3298f149ba718809f455b7f2d79c9?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Unit 42","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Unit 42","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/5b55ca8d2ae04181939041fbc9d78160","url":"https://daily.dev/sources/unit42"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/the-xcode-assassin-returns-a-deep-dive-into-the-latest-xcsset-version-0bkaeaifg","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"cyber,malware,xcode","timeRequired":"PT22M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Unit 42","item":"https://daily.dev/sources/unit42"},{"@type":"ListItem","position":3,"name":"The Xcode Assassin Returns: A Deep Dive Into the Latest XCSSET Version"}]} ```