unit42 · Crawled Jul 31, 2026
The Xcode Assassin Returns: A Deep Dive Into the Latest XCSSET Version
80 IoCs 1 Malware
Read original article ↗
AI Summary
XCSSET v40 is a sophisticated macOS malware that resurfaced in April 2026, targeting developers through supply chain attacks on Xcode projects hosted on GitHub. The malware uses a multi-stage infection chain involving memory-resident execution, polymorphic payloads, and fileless persistence to evade detection. It spreads by infecting Xcode projects and Git repositories, then downloads and executes additional modules from a command-and-control (C2) server, including a Chrome hijacking backdoor and a Telegram trojanizer. The malware disables macOS security mechanisms, blocks software updates, and manipulates browser sessions to steal credentials, cryptocurrency, and sensitive data.
AI-extracted · verify before operational use
Extracted Entities 1 found
Indicators of Compromise 80 extracted
| Type | Value | Detail |
|---|---|---|
| Domain | accapple[.]ru | Details → |
| Domain | adschecks[.]ru | Details → |
| Domain | adsmobi[.]ru | Details → |
| Domain | adsmorein[.]in | Details → |
| Domain | adsmoreme[.]in | Details → |
| Domain | amdcdn[.]ru | Details → |
| Domain | amzndev[.]in | Details → |
| Domain | amzndev[.]ru | Details → |
| Domain | amznprod[.]in | Details → |
| Domain | applecdn[.]ru | Details → |
| Domain | appledisk[.]ru | Details → |
| Domain | appledns[.]ru | Details → |
| Domain | appletime[.]in | Details → |
| Domain | bulksec[.]ru | Details → |
| Domain | cdnamz[.]in | Details → |
| Domain | cdnamz[.]ru | Details → |
| Domain | cdnapple[.]in | Details → |
| Domain | cdnatapple[.]ru | Details → |
| Domain | cdnroute[.]ru | Details → |
| Domain | checkcdn[.]ru | Details → |
| Domain | chromeads[.]ru | Details → |
| Domain | cnmag[.]ru | Details → |
| Domain | devnetaps[.]ru | Details → |
| Domain | dnsapple[.]ru | Details → |
| Domain | dnsrelays[.]ru | Details → |
| Domain | explorecdn[.]ru | Details → |
| Domain | fiddlejoy[.]ru | Details → |
| Domain | figmacat[.]ru | Details → |
| Domain | figmanets[.]in | Details → |
| Domain | funchats[.]ru | Details → |
| Domain | gironetcdn[.]ru | Details → |
| Domain | goalmate[.]ru | Details → |
| Domain | googlenets[.]ru | Details → |
| Domain | greencn[.]ru | Details → |
| Domain | icloudsnet[.]ru | Details → |
| Domain | imails[.]ru | Details → |
| Domain | legalads[.]in | Details → |
| Domain | littleads[.]in | Details → |
| Domain | littledns[.]ru | Details → |
| Domain | maganet[.]ru | Details → |
| Domain | mindelgate[.]ru | Details → |
| Domain | netapsdev[.]ru | Details → |
| Domain | netcdnads[.]in | Details → |
| Domain | netcdndev[.]ru | Details → |
| Domain | netcdndev[.]in | Details → |
| Domain | netcorps[.]ru | Details → |
| Domain | netsprot[.]in | Details → |
| Domain | netsproto[.]in | Details → |
| Domain | networkads[.]in | Details → |
| Domain | rigacdn[.]in | Details → |
| Domain | rigmajoys[.]in | Details → |
| Domain | rigmanet[.]ru | Details → |
| Domain | rigmanets[.]in | Details → |
| Domain | sahusuzuki[.]in | Details → |
| Domain | stuffdns[.]in | Details → |
| Domain | testjoys[.]ru | Details → |
| Domain | timewebnet[.]in | Details → |
| Domain | vigmanet[.]ru | Details → |
| Domain | whitead[.]in | Details → |
| Domain | whiteads[.]ru | Details → |
| Domain | wincdn[.]ru | Details → |
| Domain | windsecure[.]ru | Details → |
| IP | 91[.]108[.]106[.]229 | Details → |
| IP | 95[.]142[.]35[.]34 | Details → |
| IP | 95[.]142[.]35[.]206 | Details → |
| IP | 95[.]142[.]37[.]159 | Details → |
| IP | 151[.]243[.]109[.]188 | Details → |
| IP | 178[.]208[.]92[.]129 | Details → |
| IP | 178[.]208[.]92[.]168 | Details → |
| Filename | chrome_remote | Details → |
| Filename | Telegram.app | Details → |
| Filename | .tr | Details → |
| Filename | .tr_map | Details → |
| Filename | base_tr_file.txt | Details → |
| Filename | base_tr_map.txt | Details → |
| Filename | zw_sfp64 | Details → |
| Registry User | mpirv_eahpi_apm | Details → |
| Registry User | ychax_muwch_ucy | Details → |
| GitHub Repo | Xcode project on GitHub | Details → |
| SHA-1 | 6e480d648fa1b70612f5d198a66875e28847547d | Details → |
MITRE ATT&CK TTPs 43 techniques
T1001 Data Obfuscation · Command And Control T1003 OS Credential Dumping · Credential Access T1012 Query Registry · Discovery T1016 System Network Configuration Discovery · Discovery T1021.001 Remote Desktop Protocol · Lateral Movement T1027 Obfuscated Files or Information · Defense Evasion T1040 Network Sniffing · Credential Access T1053.005 Scheduled Task · Execution T1055 Process Injection · Defense Evasion T1056.003 Web Portal Capture · Collection T1057 Process Discovery · Discovery T1059.001 PowerShell · Execution T1059.004 Unix Shell · Execution T1070 Indicator Removal · Defense Evasion T1070.004 File Deletion · Defense Evasion T1070.006 Timestomp · Defense Evasion T1071.001 Web Protocols · Command And Control T1071.004 DNS · Command And Control T1074.001 Local Data Staging · Collection T1080 Taint Shared Content · Lateral Movement T1082 System Information Discovery · Discovery T1083 File and Directory Discovery · Discovery T1087.002 Domain Account · Discovery T1090 Proxy · Command And Control T1090.004 Domain Fronting · Command And Control T1095 Non-Application Layer Protocol · Command And Control T1098.004 SSH Authorized Keys · Persistence T1105 Ingress Tool Transfer · Command And Control T1112 Modify Registry · Defense Evasion T1113 Screen Capture · Collection T1129 Shared Modules · Execution T1133 External Remote Services · Persistence T1204.002 Malicious File · Execution T1210 Exploitation of Remote Services · Lateral Movement T1485 Data Destruction · Impact T1496 Resource Hijacking · Impact T1497 Virtualization/Sandbox Evasion · Defense Evasion T1548 Abuse Elevation Control Mechanism · Privilege Escalation T1553 Subvert Trust Controls · Defense Evasion T1555 Credentials from Password Stores · Credential Access T1557.001 LLMNR/NBT-NS Poisoning and SMB Relay · Credential Access T1566 Phishing · Initial Access T1647 Plist File Modification · Defense Evasion