The Xcode Assassin Returns: A Deep Dive Into the Latest XCSSET Version
Palo Alto Networks, Friday, July 31st, 2026
Unit 42 analyzes XCSSET v40, macOS malware that spreads through Xcode projects to target developers.
Unit 42 published analysis of XCSSET version 40, macOS malware that targets developers by infecting Xcode projects.
Infecting the development toolchain is effective because it propagates through shared projects and inherits developer trust. Unit 42 used advanced pattern matching and AI-assisted analysis to decode the malware's obfuscated logic.
The report covers the changes in this version and the persistence and collection capabilities it carries. It includes indicators of compromise for defenders in developer-heavy environments.