XCSSET v40 Malware Infects macOS Developers via Compromised Xcode Projects on GitHub
What Happened — A new XCSSET variant (v40) is spreading through maliciously altered Xcode projects hosted in public and private GitHub repositories. Developers who clone and build these projects automatically download a loader that installs 17 modules for credential theft, keylogging, browser hijacking, and data exfiltration. The campaign has been active since mid‑April 2026, targeting thousands of macOS users.
Why It Matters for Compliance & Audit Readiness
- Demonstrates a supply‑chain control gap: compromised third‑party code bypasses traditional perimeter defenses, a scenario SOC 2’s CC3 (System Operations) and CC5 (Risk Management) controls are designed to detect and document.
- Continuous evidence of code‑review and repository hardening is required to prove due diligence during an audit; the incident underscores the need for automated control mapping and evidence collection.
- Aligns with Verisq’s Control Mapping capability, which provides real‑time linkage of supply‑chain security controls to SOC 2 criteria and generates audit‑ready artifacts.
Who Is Affected – macOS application developers, software houses, and any organization that distributes or consumes code via public or private Git repositories (primarily TECH_SAAS and PROF_SERV sectors).
Recommended Actions
- Integrate automated repository scanning (SAST/SBOM) into your CI/CD pipeline and map findings to SOC 2 CC3/CC5 controls.
- Document code‑review policies, approval workflows, and evidence of remediation in a continuous‑compliance platform.
- Conduct a supply‑chain risk assessment and update third‑party vendor management records.
Technical Notes – The infection chain starts with a malicious downloader script injected into Xcode project files, then leverages a file‑less reverse shell and Chrome DevTools Protocol to hijack browsers and exfiltrate credentials. No CVE is disclosed, but the malware has previously leveraged zero‑day macOS vulnerabilities. Source: BleepingComputer