RWP Ventures RWP VenturesIntelligence

Historical intelligence backfill. This assessment covers reporting originally published on 2025-09-25 and was added to the RWP archive on 2026-09-07.

Daily Top · Supply chain

XCSSET's 2025 turn made shared Xcode projects a developer-to-developer supply chain

Microsoft documented another XCSSET variant that still infects Xcode projects at build time, then added Firefox theft, clipboard crypto-swap, and LaunchDaemon persistence.

RWP Ventures · 2026-09-07 · event 2025-09-25 · 3 min read · priority 7.2

Bottom line up front

CONFIRMED On 25 September 2025 Microsoft Threat Intelligence published a new XCSSET variant, beyond the March 2025 modules, still spreading by infecting Xcode projects so the payload runs when a developer builds. New or reworked pieces: Firefox data theft via a modified HackBrowserData build, clipboard hijacking against cryptocurrency addresses, LaunchDaemon persistence (hidden .root payload), a decoy System Settings.app under /tmp, run-only AppleScript obfuscation, and attempts to disable macOS automatic updates and Rapid Security Responses.

Microsoft described the use as limited targeted attacks and said it notified Apple and GitHub to take down related repositories. Historical backfill of 25 September 2025 reporting; added 7 September 2026.

What happened

XCSSET has been a macOS developer-project infector since at least 2020. The 2025 refresh does not need a zero-day in macOS. It needs a developer to open or build a poisoned project — often one shared among contractors, Git clones, or "starter" repos.

The four-stage chain Microsoft described ends in submodules. The interesting change is monetization plus stealth: browser theft expanded off Safari/Chrome-era modules onto Firefox; clipboard swap is classic crypto-drain; LaunchDaemon plus a fake Settings app is how you stay after the Xcode window closes.

The Register and TechRadar match those module names and the limited-attack qualifier. That qualifier is important: this is not a consumer mass worm in Microsoft's telling.

Why it mattered

Enterprise Mac security still under-weights developer workstations. Those machines hold:

A project-file infector is a supply-chain issue inside the company even when npm is clean. It also turns every zip of an Xcode tree into a USB-stick-era spreading mechanism.

Disabling Rapid Security Responses is a tell that the operator wants dwell time, not a smash-and-grab.

Who / what was affected

CONFIRMED Apple-platform developers using Xcode; Microsoft observed limited attacks.

REPORTED GitHub repositories taken down after Microsoft collaboration.

UNKNOWN exact victim count, attribution beyond historical XCSSET operators, and whether any downstream App Store build was poisoned in this wave.

If your company has a single Mac "build goat" that every contractor uses, that host is the blast radius.

Technical context

Build-time infection beats "don't run random apps." The developer intends to compile. Persistence then leaves the Xcode context:

RWP will not reconstruct the four-stage loader. Hunt on the persistence and browser-theft behaviors Microsoft already published.

Exploitation / threat status at the time

CONFIRMED variant in the wild; Microsoft public analysis 25 September 2025; Apple/GitHub notified.

REPORTED limited attacks, not a broad outbreak.

UNKNOWN overlap with later 2026 macOS ClickFix reporting (separate registry item).

What defenders should have done

  1. Treat Xcode project provenance like package provenance: known remotes, signed commits, no mystery zips from Discord.
  2. Endpoint: alert on new LaunchDaemons, unexpected System Settings.app paths under /tmp, disabled softwareupdate/RSR, and clipboard daemons in developer users.
  3. Browser isolation on developer Macs that also hold production IdP sessions.
  4. Secret scanning in CI for Apple certs, not just AWS keys.
  5. Incident response playbook for "poisoned repo" that includes every machine that built it, not just the first clone.

What we know now

XCSSET did not become the 2026 headline macOS story; ClickFix-style social engineering did. The durable issue is unchanged: developer endpoints are production-adjacent, and project files are an execution path.

RWP assessment

Confidence: High on Microsoft's module list and limited-use statement as of the blog. Low on actor identity and scale.

If you only lock down npm and leave Xcode projects as unstructured files on laptops, you have a second supply chain you are not watching.

Defensive actions

  1. Inventory Mac developer fleet and require MDM with update/RSR enforcement that users cannot silently disable.
  2. Block unknown LaunchDaemons on those hosts.
  3. Educate contractors: do not share full .xcodeproj trees out of band.
  4. After any suspect repo, rotate Apple, Git, and cloud credentials from a clean machine.

Sources

  1. Microsoft Threat Intelligence — XCSSET evolves again: Analyzing the latest updates to XCSSET’s inventory
  2. The Register — Microsoft spots XCSSET strain hiding in Apple dev projects
  3. TechRadar — Microsoft flags dangerous XCSSET macOS malware targeting developers
  4. Malware.news — XCSSET evolves again (syndicated Microsoft analysis)

Related intelligence