XCSSET v40 — Xcode Supply-Chain Malware Targeting macOS Developers

XCSSET is a modular macOS malware family first documented by Trend Micro in August 2020, historically distributed by injecting malicious code into Apple Xcode projects. After months of dormancy, Palo Alto Networks Unit 42 identified a resurgence beginning in mid-April 2026, with a second wave in early May 2026 that expanded the module set. Unit 42 published the full technical analysis as v40 on 2026-07-31, and it was independently corroborated by BleepingComputer, GBHackers and Cyber Security News in the first week of August 2026.

The infection vector is unchanged from XCSSET's original design and remains its most dangerous property: the actor compromises vulnerable Git repositories and injects a downloader script into benign files inside legitimate Xcode projects — dozens of applications with active user bases have been affected. When a developer clones and builds the tainted project, the loader executes under the developer's own user context, inheriting broad access without triggering conventional permission prompts. From there XCSSET infects every other local Xcode project on the machine and propagates further through shared source code — ordinary git commit and push activity becomes the worm's transport layer.

v40's architectural advance is hiding as much of its logic as possible in memory. A four-stage chain (loader → host fingerprint → staging applet → in-memory "boot" module) loads 17 specialized modules without writing a stable binary to disk. The loader is recompiled on the C2 server every few hours — Unit 42 observed roughly 8 distinct file hashes in 24 hours for functionally identical code — which is why no usable file hash IOC exists for this campaign and why this pack leans on network and behavioral detection instead. Two modules are new in v40: a Chrome hijacker that wraps the legitimate Chrome binary and abuses the Chrome DevTools Protocol (CDP) to inject JavaScript, intercept fetch/XMLHttpRequest calls, tamper with cryptocurrency wallet transactions, and open a fileless reverse shell through the browser's own console channel; and a Telegram Desktop trojanizer that downloads a malicious Telegram.app archive, wipes the legitimate install, drops an ad hoc-signed C2-controlled replacement, and kills the original process so the user transparently relaunches the trojanized client. v40 also actively impairs macOS defenses: it disables the SoftwareUpdate configuration channel, terminates CloudTelemetryService, locks the XProtect signature database with an exclusive Perl file lock, and resets the TCC database to re-trigger (and desensitize users to) permission prompts.

Defender priority: Because hashes are worthless against this loader, prioritize the network and behavioral signals in this pack over file-based detection. The three highest-value, lowest-noise hunts are: (1) DNS/network traffic to the 62 published C2 domains and 7 C2 IPs (Q1, Q2) — attacker-owned infrastructure with zero legitimate use; (2) any process retrieving the CDP helper binary via the string zw_sfp64 (Q4) — a unique attacker-chosen token; and (3) Chrome launched with --remote-debugging-port by a non-test-automation parent (Q3), which is the enablement step for the browser hijack. The shared SSL certificate thumbprint 6e480d648fa1b70612f5d198a66875e28847547d is a durable pivot across the four operator IPs even as they rotate.

Six sources were fetched and snapshotted to XCSSET-v40-Hunt-sources/. Every atomic indicator shipped in section 4/10 traces to the Unit 42 primary snapshot and is cross-validated against the two independent press write-ups below.

Research notes and deliberate exclusions

• No file hashes are shipped, and none were invented. Unit 42 explicitly attributes this to per-build server-side recompilation (~8 distinct hashes per 24 hours for the loader alone). A live MalwareBazaar query for tag:XCSSET was attempted during this research and was blocked by a bot-check interstitial — recorded as a research gap, not a negative finding. The IOC appendix ships a labelled REPLACE_WITH_SHA256 placeholder rather than a fabricated value.
• Domain count discrepancy, disclosed rather than papered over: Unit 42's prose states "70+" C2 domains; the domain list explicitly enumerated in the fetched extract contains 62 distinct entries. This pack ships the 62 that are individually named and verifiable in the saved snapshot — it does not round up to "70+" or invent the remainder.
• Cross-validation: the starter IOC set supplied for this hunt (sample domains, all 7 IPs, the SSL thumbprint, and the 6 CDP helper URLs) matches the Unit 42 primary source exactly and is independently corroborated by GBHackers and Cyber Security News. No indicator in this pack came from a single uncorroborated source.
• MITRE ATT&CK S0658 reflects only legacy (pre-2026) XCSSET. The v40-specific capabilities — CDP browser hijacking, Telegram Desktop trojanization, defaults-based fileless persistence, and the XProtect/MRT/TCC/SoftwareUpdate impairment — are not yet cataloged under S0658 as of this fetch. Section 6 flags every v40-specific mapping as analyst-inferred from the Unit 42/press write-ups rather than pulled from the ATT&CK catalog.
• No prompt-injection or suspicious embedded instructions were observed in any fetched source during this research. All six pages returned ordinary threat-intelligence prose; nothing resembling an attempt to redirect this pipeline's behavior was present.

Hunt hypotheses (ordered by fidelity)

Attack chain

76 atomic indicators — 62 domains, 7 IPv4, 6 CDP helper URLs, 1 SSL certificate thumbprint. All published by Unit 42 (2026-07-31) and cross-validated against GBHackers and Cyber Security News. No file hashes are published for this campaign (see section 2) — that row is included with (none published) per the pipeline convention rather than omitted.

Perishability: the 7 IPv4 addresses are rated medium confidence and carry the shortest expiry in this pack (30 days) — commodity/bulletproof hosting reassigns fast. The SSL thumbprint is the more durable pivot if the IPs rotate but the operators reuse certificate material, as GBHackers independently observed across campaign waves.

Legacy techniques are from the MITRE ATT&CK S0658 catalog. Rows marked (v40 — analyst-mapped) describe v40-specific capabilities documented by Unit 42/press but not yet reflected in the S0658 catalog as of this pack's research date.

Checks that do not require Falcon telemetry — run these in parallel, especially for the propagation vector and in-memory stages Falcon cannot see directly.

• Git repository review — diff-review recently pushed commits to Xcode projects for unexpected changes to project.pbxproj Run Script build phases; treat any unfamiliar build-phase script as hostile until proven otherwise, especially in forked or third-party-contributed projects.
• macOS unified log (log show --predicate) — search for defaults write events creating unfamiliar preference domains, tccutil reset invocations, and Perl processes touching paths under /Library/Apple/System/Library/CoreServices/XProtect.bundle.
• Dependency/supply-chain scanning — scan cloned or forked Xcode projects for hidden or unfamiliar build phases before opening them in Xcode; treat this as mandatory for any project pulled from outside your own org.
• Chrome integrity audit — compare the installed Chrome binary's hash against Google's published release hash; review LaunchAgents/LaunchDaemons and any wrapper scripts around /Applications/Google Chrome.app for tampering.
• Telegram Desktop integrity audit — compare the installed Telegram.app bundle's code signature against the official Telegram Team ID. An ad hoc signature (codesign -dv showing no Authority= chain to a real Team ID) is a strong indicator of the trojanizer.
• MDM/Jamf fleet sweep — inventory ad hoc-signed applications bypassing Gatekeeper across the managed developer fleet; cross-reference against your approved-software baseline.

The Falcon macOS sensor emits the same core event taxonomy used below (ProcessRollup2/SyntheticProcessRollup2, NetworkConnectIP4, DnsRequest) as Windows/Linux. macOS has no registry, so persistence is hunted via CommandLine patterns (defaults, tccutil) rather than RegGenericValueUpdate.

// HUNT: DNS resolution of published XCSSET v40 C2 domains
// MITRE: T1071.001 (Web Protocols), T1568 (Dynamic Resolution)
// CONF: high | FP: low | COST: low
// REQUIRES: DnsRequest
// FALSE POSITIVES: none expected — domains are attacker-registered infrastructure with no legitimate use
#event_simpleName=/^(DnsRequest|SuspiciousDnsRequest)$/
| in(field=DomainName, values=["accapple.ru","adschecks.ru","adsmobi.ru","adsmorein.in","amdcdn.ru","amzndev.in","amzndev.ru","amznprod.in","applecdn.ru","appledisk.ru","appledns.ru","applehosts.ru","appletime.in","bulksec.ru","cdnamz.in","cdnamz.ru","cdnapple.in","cdnatapple.ru","cdnroute.ru","checkcdn.ru","chromeads.ru","cnmag.ru","devnetaps.ru","dnsapple.ru","dnsrelays.ru","explorecdn.ru","fiddlejoy.ru","figmacat.ru","figmanets.in","funchats.ru","gironetcdn.ru","goalmate.ru","googlenets.ru","greencn.ru","icloudsnet.ru","imails.ru","legalads.in","littleads.in","littledns.ru","maganet.ru","mindelgate.ru","netapsdev.ru","netcdnads.in","netcdnamz.ru","netcdndev.in","netcorps.ru","netsprot.in","netsproto.in","networkads.in","rigacdn.in","rigmajoys.in","rigmanet.ru","rigmanets.in","sahusuzuki.in","stuffdns.in","testjoys.ru","timewebnet.in","vigmanet.ru","whitead.in","whiteads.ru","wincdn.ru","windsecure.ru"])
| table([ComputerName, UserName, DomainName, ContextBaseFileName, ContextProcessId])

// HUNT: Outbound connection to published XCSSET v40 C2 IPv4 infrastructure
// MITRE: T1071.001, T1573.001 (Symmetric Cryptography)
// CONF: high | FP: low | COST: low
// REQUIRES: NetworkConnectIP4
// FALSE POSITIVES: none expected — hosting is dedicated to this campaign's operators
#event_simpleName=/^NetworkConnectIP4$/
| in(field=RemoteAddressIP4, values=["91.108.106.229","95.142.35.34","95.142.35.206","95.142.37.159","151.243.109.188","178.208.92.129","178.208.92.168"])
| table([ComputerName, UserName, ContextBaseFileName, RemoteAddressIP4, RemotePort])

// HUNT: Google Chrome launched with the remote-debugging-port flag (CDP hijack enablement)
// MITRE: T1554 (Compromise Host Software Binary), T1539 (Steal Web Session Cookie) — v40 analyst-mapped, CDP abuse has no discrete ATT&CK sub-technique yet
// CONF: medium | FP: medium | COST: low
// REQUIRES: ProcessRollup2, SyntheticProcessRollup2
// FALSE POSITIVES: QA/automation engineers and Selenium/Puppeteer/Playwright test harnesses legitimately launch Chrome with --remote-debugging-port
// TUNING: exclude known CI/test-runner parent processes (e.g. node, python running pytest/selenium) by ParentBaseFileName before alerting
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| FileName=/^Google Chrome$/i
| CommandLine=/--remote-debugging-port/i
| table([ComputerName, UserName, ParentBaseFileName, FileName, CommandLine])

// HUNT: Process retrieving the XCSSET v40 Chrome CDP helper binary (zw_sfp64)
// MITRE: T1105 (Ingress Tool Transfer)
// CONF: high | FP: low | COST: low
// REQUIRES: ProcessRollup2, SyntheticProcessRollup2
// FALSE POSITIVES: none expected — zw_sfp64 is a unique attacker-chosen filename with no legitimate use
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| CommandLine=/zw_sfp64/i
| table([ComputerName, UserName, ParentBaseFileName, FileName, CommandLine])

// HUNT: Xcode or xcodebuild spawning a shell that downloads and executes content (poisoned build-phase script)
// MITRE: T1195.001 (Compromise Software Dependencies and Development Tools), T1059.004 (Unix Shell)
// CONF: medium | FP: medium | COST: medium
// REQUIRES: ProcessRollup2, SyntheticProcessRollup2
// FALSE POSITIVES: legitimate CocoaPods/Carthage/SPM build-phase scripts and CI pipelines (fastlane, GitHub Actions runners) also invoke curl/bash from Xcode build steps
// TUNING: exclude your known CI runner identities and pinned dependency-manager scripts by ParentBaseFileName/CommandLine before alerting; prioritize hits where the downloaded URL matches Q1/Q2 infrastructure
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| ParentBaseFileName=/^(xcodebuild|Xcode)$/i
| CommandLine=/(curl|wget)\s/i
| table([ComputerName, UserName, ParentBaseFileName, FileName, CommandLine])

// HUNT: defaults(1) writing a base64-style payload into a newly created preference domain
// MITRE: T1027.013 (Encrypted/Encoded File), T1564.001 (Hidden Files and Directories)
// CONF: medium | FP: high | COST: low
// REQUIRES: ProcessRollup2, SyntheticProcessRollup2
// FALSE POSITIVES: legitimate software (browsers, Office apps, MDM agents) write long base64/plist blobs to defaults domains routinely
// TUNING: scope to defaults invocations whose parent is NOT a known Apple/MDM/browser process, and whose value argument exceeds ~200 chars; treat as a lead requiring correlation with Q1/Q2/Q4, never a standalone alert
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| FileName=/^defaults$/i
| CommandLine=/write/i
| CommandLine=/[A-Za-z0-9+\/=]{200,}/
| table([ComputerName, UserName, ParentBaseFileName, FileName, CommandLine])

// HUNT: tccutil reset invoked outside of normal user/admin workflow
// MITRE: T1548.006 (TCC Manipulation)
// CONF: medium | FP: medium | COST: low
// REQUIRES: ProcessRollup2, SyntheticProcessRollup2
// FALSE POSITIVES: developers/QA legitimately run tccutil reset when testing permission prompts; MDM remediation scripts may also invoke it
// TUNING: exclude your MDM/Jamf remediation script identity and known developer/QA host groups; prioritize hits with no interactive UserName session at the time
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| FileName=/^tccutil$/i
| CommandLine=/reset/i
| table([ComputerName, UserName, ParentBaseFileName, FileName, CommandLine])

// HUNT: Commands disabling macOS security telemetry, update checks, or XProtect (v40 defense impairment)
// MITRE: T1562.001 (Disable or Modify Tools) — v40 analyst-mapped; not in the legacy S0658 catalog
// CONF: medium | FP: medium | COST: low
// REQUIRES: ProcessRollup2, SyntheticProcessRollup2
// FALSE POSITIVES: MDM/Jamf policies and Apple's own installer occasionally toggle SoftwareUpdate scheduling; rare legitimate admin scripts kill telemetry daemons during troubleshooting
// TUNING: exclude your MDM remediation identity and scope to processes with no code-signing chain to Apple or your MDM vendor
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| CommandLine=/(CloudTelemetryService|softwareupdate --schedule off|com\.apple\.SoftwareUpdate)/i
| table([ComputerName, UserName, ParentBaseFileName, FileName, CommandLine])

// HUNT: Telegram Desktop replaced or re-signed with an ad hoc signature after a kill/relaunch sequence
// MITRE: T1554 (Compromise Host Software Binary), T1036 (Masquerading)
// CONF: medium | FP: medium | COST: low
// REQUIRES: ProcessRollup2, SyntheticProcessRollup2
// FALSE POSITIVES: legitimate Telegram auto-update also kills and relaunches the app; developers ad hoc-sign their own builds during testing
// TUNING: correlate with a preceding download from Q1/Q2/Q4 infrastructure; flag only when codesign shows no valid Telegram FZ LLC Team ID
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| CommandLine=/codesign/i
| CommandLine=/Telegram/i
| table([ComputerName, UserName, ParentBaseFileName, FileName, CommandLine])

Five queries are strong enough to promote from hunt to Custom IOA. Q5, Q6, Q7 and Q9 carry tunable false-positive surface and stay investigate-only until baselined in your environment.

Deployment path: Endpoint security → Custom IOA rule groups → create a macOS Process Creation / DNS / Network group, add the five rules above in Monitor mode first. The C2 domain and CDP helper rules are safe to promote directly to Block; the Chrome CDP and defense-impairment rules need at least one week of baseline against your developer and MDM populations before enforcement.

Alert Triage Package — C2 Communication (Q1 + Q2)

Scheduled Search name: HUNT: XCSSET v40 - C2 Domain/IP Communication

Scheduled Search description: Detects DNS resolution or outbound connection to infrastructure published for the XCSSET v40 macOS supply-chain campaign (62 domains, 7 IPv4 addresses sharing SSL thumbprint 6e480d648fa1b70612f5d198a66875e28847547d). A hit indicates an infected Xcode-built host has established or is attempting C2 communication.

MITRE: T1071.001 (Web Protocols), T1573.001 (Symmetric Cryptography) · Tactics: Command and Control · Priority: HIGH (escalate immediately if the resolving/connecting process is Xcode, xcodebuild, a staging applet, or Chrome) · FP Sources: none expected — dedicated attacker infrastructure.

Subject: 🚨 HUNT ALERT 🚨 — XCSSET v40 C2 Communication Detected (Possible Supply-Chain Compromise)

Body: A host resolved or connected to published XCSSET v40 C2 infrastructure. This campaign spreads via poisoned Xcode projects — the initiating process and any recent Xcode/xcodebuild build activity on this host are the first things to check. Note: DNS resolution alone does not confirm compromise, but any correlated NetworkConnectIP4 hit does. Check ContextBaseFileName for the initiating process, then pivot to Q4/Q6 on the same host.

Investigation checklist:

1. Identify the initiating process — check ContextBaseFileName/ContextProcessId on the DNS or network event.
2. Check whether the host has Xcode installed and whether a build occurred in the last 24 hours (correlate with Q5 hits).
3. Run Q4 (CDP helper download) and Q6 (defaults staging) on the same host and timeframe.
4. Check for Chrome processes with --remote-debugging-port (Q3) on the same host.
5. Identify which local Xcode projects exist on the host and whether any were recently cloned from an external/forked source.
6. Isolate if: a NetworkConnectIP4 hit is confirmed (not just DNS) and any of Q3/Q4/Q6 also fire on the same host.

Pivot queries:

>> YOU NEED: ComputerName (from the alert)  >> FILL IN: ComputerName="REPLACE_WITH_HOSTNAME"

// Host-scoped: all XCSSET v40-related activity on the affected host, last 7d
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2|DnsRequest|NetworkConnectIP4)$/
| ComputerName="REPLACE_WITH_HOSTNAME"
| (CommandLine=/zw_sfp64/i or CommandLine=/(CloudTelemetryService|softwareupdate --schedule off)/i or FileName=/^defaults$/i or FileName=/^Google Chrome$/i)
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine])

// Environment-wide: hosts touching XCSSET v40 infrastructure, ranked by hit count
#event_simpleName=/^(DnsRequest|NetworkConnectIP4)$/
| in(field=DomainName, values=["accapple.ru","googlenets.ru","whitead.in"]) or in(field=RemoteAddressIP4, values=["91.108.106.229","95.142.35.34"])
| groupBy([ComputerName], function=count(as=Hits), limit=500)
| sort(Hits, order=desc)

Alert Triage Package — Chrome CDP Hijack (Q3 + Q4)

Scheduled Search name: HUNT: XCSSET v40 - Chrome CDP Hijack Enablement

Scheduled Search description: Detects the browser-hijack enablement sequence introduced in XCSSET v40 — Chrome launched with a remote-debugging flag, or a process retrieving the campaign's CDP helper binary via the unique token zw_sfp64. Used to catch credential, cookie and crypto-wallet-transaction interception before it reaches the exfiltration stage.

MITRE: T1554 (Compromise Host Software Binary), T1539 (Steal Web Session Cookie), T1105 (Ingress Tool Transfer) · Tactics: Credential Access, Command and Control · Priority: HIGH (escalate immediately if the zw_sfp64 download is confirmed — that variant has no legitimate explanation) · FP Sources: Selenium/Puppeteer/Playwright test automation, CI browser-testing pipelines.

Subject: ⚠️ HUNT ALERT ⚠️ — Chrome CDP Hijack Enablement Detected (Possible Browser Session Theft)

Body: Chrome was launched with debugging enabled, or a process downloaded the XCSSET v40 CDP helper binary. If the CDP helper download is confirmed, treat this as active compromise — the helper connects to the exposed CDP port and can harvest cookies, autofill data and crypto-wallet transactions in real time. Check the parent process first: a test-automation framework (Selenium/Puppeteer/pytest) is likely benign; anything else, especially a process also seen in the C2 alert above, is high priority.

Investigation checklist:

1. Check ParentBaseFileName for the Chrome launch — CI/test-runner parent = likely benign; anything else = escalate.
2. Check whether zw_sfp64 appears anywhere in the same host's recent CommandLine history (Q4).
3. Check for a concurrent or preceding hit on Q1/Q2 (C2 infrastructure) on the same host.
4. If confirmed, treat all credentials and session cookies stored in that Chrome profile as compromised.
5. Check for crypto-wallet browser extensions on the host — CDP hijack specifically targets wallet transaction data.
6. Isolate if: zw_sfp64 download is confirmed, or the CDP flag hit correlates with a Q1/Q2 C2 hit on the same host.

Pivot queries:

>> YOU NEED: ComputerName (from the alert)     Alert timestamp (from Step 1 — set LogScale window to ±30 min)  >> FILL IN: ComputerName="REPLACE_WITH_HOSTNAME"

// Host-scoped: Chrome process tree and CDP helper activity around the alert
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| ComputerName="REPLACE_WITH_HOSTNAME"
| (FileName=/^Google Chrome$/i or CommandLine=/zw_sfp64/i)
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine])

// Environment-wide: frequency of zw_sfp64 helper retrieval across the fleet
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| CommandLine=/zw_sfp64/i
| groupBy([ComputerName], function=count(as=Hits), limit=500)
| sort(Hits, order=desc)

Investigate-only — Defense Impairment (Q8)

No full alert email; treat as an escalation lead. If Q8 fires, immediately cross-check the same host against Q1/Q2/Q4 — a lone defense-impairment hit with no corroborating C2 activity is more likely a legitimate MDM remediation script and should be triaged, not escalated, until corroborated.

type,value,action,severity,expiration,description,tags
domain,accapple.ru,detect,high,2026-11-07,XCSSET v40 C2 infrastructure,campaign:XCSSET-v40
domain,adschecks.ru,detect,high,2026-11-07,XCSSET v40 C2 infrastructure,campaign:XCSSET-v40
domain,adsmobi.ru,detect,high,2026-11-07,XCSSET v40 C2 infrastructure,campaign:XCSSET-v40
domain,adsmorein.in,detect,high,2026-11-07,XCSSET v40 C2 infrastructure,campaign:XCSSET-v40
domain,amdcdn.ru,detect,high,2026-11-07,XCSSET v40 C2 infrastructure,campaign:XCSSET-v40
domain,amzndev.in,detect,high,2026-11-07,XCSSET v40 C2 infrastructure and CDP helper host,campaign:XCSSET-v40
domain,amzndev.ru,detect,high,2026-11-07,XCSSET v40 C2 infrastructure and CDP helper host,campaign:XCSSET-v40
domain,amznprod.in,detect,high,2026-11-07,XCSSET v40 C2 infrastructure,campaign:XCSSET-v40
domain,applecdn.ru,detect,high,2026-11-07,XCSSET v40 C2 infrastructure,campaign:XCSSET-v40
domain,appledisk.ru,detect,high,2026-11-07,XCSSET v40 C2 infrastructure,campaign:XCSSET-v40
domain,appledns.ru,detect,high,2026-11-07,XCSSET v40 C2 infrastructure,campaign:XCSSET-v40
domain,applehosts.ru,detect,high,2026-11-07,XCSSET v40 C2 infrastructure,campaign:XCSSET-v40
domain,appletime.in,detect,high,2026-11-07,XCSSET v40 C2 infrastructure,campaign:XCSSET-v40
domain,bulksec.ru,detect,high,2026-11-07,XCSSET v40 C2 infrastructure,campaign:XCSSET-v40
domain,cdnamz.in,detect,high,2026-11-07,XCSSET v40 C2 infrastructure,campaign:XCSSET-v40
domain,cdnamz.ru,detect,high,2026-11-07,XCSSET v40 C2 infrastructure,campaign:XCSSET-v40
domain,cdnapple.in,detect,high,2026-11-07,XCSSET v40 C2 infrastructure,campaign:XCSSET-v40
domain,cdnatapple.ru,detect,high,2026-11-07,XCSSET v40 C2 infrastructure,campaign:XCSSET-v40
domain,cdnroute.ru,detect,high,2026-11-07,XCSSET v40 C2 infrastructure,campaign:XCSSET-v40
domain,checkcdn.ru,detect,high,2026-11-07,XCSSET v40 C2 infrastructure,campaign:XCSSET-v40
domain,chromeads.ru,detect,high,2026-11-07,XCSSET v40 C2 infrastructure,campaign:XCSSET-v40
domain,cnmag.ru,detect,high,2026-11-07,XCSSET v40 C2 infrastructure,campaign:XCSSET-v40
domain,devnetaps.ru,detect,high,2026-11-07,XCSSET v40 C2 infrastructure,campaign:XCSSET-v40
domain,dnsapple.ru,detect,high,2026-11-07,XCSSET v40 C2 infrastructure,campaign:XCSSET-v40
domain,dnsrelays.ru,detect,high,2026-11-07,XCSSET v40 C2 infrastructure,campaign:XCSSET-v40
domain,explorecdn.ru,detect,high,2026-11-07,XCSSET v40 C2 infrastructure,campaign:XCSSET-v40
domain,fiddlejoy.ru,detect,high,2026-11-07,XCSSET v40 C2 infrastructure,campaign:XCSSET-v40
domain,figmacat.ru,detect,high,2026-11-07,XCSSET v40 C2 infrastructure,campaign:XCSSET-v40
domain,figmanets.in,detect,high,2026-11-07,XCSSET v40 C2 infrastructure,campaign:XCSSET-v40
domain,funchats.ru,detect,high,2026-11-07,XCSSET v40 C2 infrastructure,campaign:XCSSET-v40
domain,gironetcdn.ru,detect,high,2026-11-07,XCSSET v40 C2 infrastructure,campaign:XCSSET-v40
domain,goalmate.ru,detect,high,2026-11-07,XCSSET v40 C2 infrastructure,campaign:XCSSET-v40
domain,googlenets.ru,detect,high,2026-11-07,XCSSET v40 C2 infrastructure and CDP helper host,campaign:XCSSET-v40
domain,greencn.ru,detect,high,2026-11-07,XCSSET v40 C2 infrastructure,campaign:XCSSET-v40
domain,icloudsnet.ru,detect,high,2026-11-07,XCSSET v40 C2 infrastructure,campaign:XCSSET-v40
domain,imails.ru,detect,high,2026-11-07,XCSSET v40 C2 infrastructure,campaign:XCSSET-v40
domain,legalads.in,detect,high,2026-11-07,XCSSET v40 C2 infrastructure,campaign:XCSSET-v40
domain,littleads.in,detect,high,2026-11-07,XCSSET v40 C2 infrastructure,campaign:XCSSET-v40
domain,littledns.ru,detect,high,2026-11-07,XCSSET v40 C2 infrastructure,campaign:XCSSET-v40
domain,maganet.ru,detect,high,2026-11-07,XCSSET v40 C2 infrastructure,campaign:XCSSET-v40
domain,mindelgate.ru,detect,high,2026-11-07,XCSSET v40 C2 infrastructure,campaign:XCSSET-v40
domain,netapsdev.ru,detect,high,2026-11-07,XCSSET v40 C2 infrastructure,campaign:XCSSET-v40
domain,netcdnads.in,detect,high,2026-11-07,XCSSET v40 C2 infrastructure,campaign:XCSSET-v40
domain,netcdnamz.ru,detect,high,2026-11-07,XCSSET v40 C2 infrastructure,campaign:XCSSET-v40
domain,netcdndev.in,detect,high,2026-11-07,XCSSET v40 C2 infrastructure and CDP helper host,campaign:XCSSET-v40
domain,netcorps.ru,detect,high,2026-11-07,XCSSET v40 C2 infrastructure,campaign:XCSSET-v40
domain,netsprot.in,detect,high,2026-11-07,XCSSET v40 C2 infrastructure,campaign:XCSSET-v40
domain,netsproto.in,detect,high,2026-11-07,XCSSET v40 C2 infrastructure,campaign:XCSSET-v40
domain,networkads.in,detect,high,2026-11-07,XCSSET v40 C2 infrastructure,campaign:XCSSET-v40
domain,rigacdn.in,detect,high,2026-11-07,XCSSET v40 C2 infrastructure,campaign:XCSSET-v40
domain,rigmajoys.in,detect,high,2026-11-07,XCSSET v40 C2 infrastructure,campaign:XCSSET-v40
domain,rigmanet.ru,detect,high,2026-11-07,XCSSET v40 C2 infrastructure,campaign:XCSSET-v40
domain,rigmanets.in,detect,high,2026-11-07,XCSSET v40 C2 infrastructure,campaign:XCSSET-v40
domain,sahusuzuki.in,detect,high,2026-11-07,XCSSET v40 C2 infrastructure,campaign:XCSSET-v40
domain,stuffdns.in,detect,high,2026-11-07,XCSSET v40 C2 infrastructure,campaign:XCSSET-v40
domain,testjoys.ru,detect,high,2026-11-07,XCSSET v40 C2 infrastructure,campaign:XCSSET-v40
domain,timewebnet.in,detect,high,2026-11-07,XCSSET v40 C2 infrastructure,campaign:XCSSET-v40
domain,vigmanet.ru,detect,high,2026-11-07,XCSSET v40 C2 infrastructure,campaign:XCSSET-v40
domain,whitead.in,detect,high,2026-11-07,XCSSET v40 C2 infrastructure and CDP helper host,campaign:XCSSET-v40
domain,whiteads.ru,detect,high,2026-11-07,XCSSET v40 C2 infrastructure and CDP helper host,campaign:XCSSET-v40
domain,wincdn.ru,detect,high,2026-11-07,XCSSET v40 C2 infrastructure,campaign:XCSSET-v40
domain,windsecure.ru,detect,high,2026-11-07,XCSSET v40 C2 infrastructure,campaign:XCSSET-v40
ipv4,91.108.106.229,detect,high,2026-09-08,XCSSET v40 C2 operator IP,campaign:XCSSET-v40
ipv4,95.142.35.34,detect,high,2026-09-08,XCSSET v40 C2 operator IP,campaign:XCSSET-v40
ipv4,95.142.35.206,detect,high,2026-09-08,XCSSET v40 C2 operator IP,campaign:XCSSET-v40
ipv4,95.142.37.159,detect,high,2026-09-08,XCSSET v40 C2 operator IP,campaign:XCSSET-v40
ipv4,151.243.109.188,detect,high,2026-09-08,XCSSET v40 C2 operator IP,campaign:XCSSET-v40
ipv4,178.208.92.129,detect,high,2026-09-08,XCSSET v40 C2 operator IP,campaign:XCSSET-v40
ipv4,178.208.92.168,detect,high,2026-09-08,XCSSET v40 C2 operator IP,campaign:XCSSET-v40

# XCSSET v40 behavioral signatures (no atomic IOC form)
# C2 endpoint taxonomy (Unit 42)
GET  /d/<name>   binary download
GET  /a           loader retrieval
GET  /s/<module> module retrieval
POST /l           status/log reporting
POST /u           file exfiltration
POST /p           heartbeat
GET  /w?cmd       dynamic configuration
POST /e           browser-hijack events
# Chrome CDP hijack
Unique download token: zw_sfp64
Helper binary: chrome_remote
Chrome launched with --remote-debugging-port by a non-automation parent
Fileless reverse shell channel: marked console.log events over the CDP WebSocket
# Fileless persistence
defaults write into a per-host-generated preference domain, base64-encoded payload
# Defense impairment
Perl process taking an exclusive file lock on the XProtect signature database
killall / pkill targeting CloudTelemetryService
softwareupdate --schedule off / com.apple.SoftwareUpdate preference writes
tccutil reset invoked outside interactive admin context
# Telegram trojanizer
Download of a Telegram.app replacement archive, followed by kill + ad hoc codesign + relaunch
# TLS pivot (durable across IP rotation)
SSL certificate thumbprint: 6e480d648fa1b70612f5d198a66875e28847547d
# 17 named modules (Unit 42)
boot, stats, clipboard_v2, payloader, replicator_finder, git_finder, zip_infect_finder,
data_folders_finder, firefox_data, notes_app, settings_app, finder_app, persist,
browser_remote, safari_remote, chrome_remote, tdesktop

https://amzndev.in/d/zw_sfp64
https://amzndev.ru/d/zw_sfp64
https://googlenets.ru/d/zw_sfp64
https://netcdndev.in/d/zw_sfp64
https://whitead.in/d/zw_sfp64
https://whiteads.ru/d/zw_sfp64

Family:        XCSSET (first documented Trend Micro, August 2020)
Version:       v40 (mid-April 2026 wave, expanded early May 2026 wave)
Primary vector: Poisoned/compromised Xcode projects on GitHub
New modules:   Chrome hijacker (chrome_remote, via CDP), Telegram Desktop trojanizer (tdesktop)
Vendor source: Palo Alto Networks Unit 42 (2026-07-31)
MITRE ATT&CK:  S0658 (legacy catalog entry; v40 capabilities not yet indexed)

# No SHA256/MD5/SHA1 file hashes have been published for XCSSET v40 by any
# vendor as of this pack's research date (2026-08-09). Unit 42 explicitly
# attributes this to server-side recompilation of the loader every few
# hours (~8 distinct hashes per 24 hours for functionally identical code).
# A live MalwareBazaar tag:XCSSET query was attempted and blocked by a
# bot-check interstitial (research gap, not a negative result).
sha256,REPLACE_WITH_SHA256,detect,high,2027-08-09,XCSSET v40 sample — populate only from your own detonation/VT lookup,campaign:XCSSET-v40
# Do not invent or derive a hash value. An unsourced hash is not an indicator.

# Before building any Xcode project pulled from outside your own org:
[ ] Diff project.pbxproj against the last known-good commit for new/modified
    Run Script build phases
[ ] Confirm ENABLE_USER_SCRIPT_SANDBOXING is set for all build-phase scripts
    (Xcode 15+)
[ ] Review any curl/wget/base64/eval usage inside build-phase shell scripts
[ ] Confirm the repo's recent commit history has no unexplained force-pushes
    or unsigned commits from unfamiliar authors
[ ] Cross-reference any embedded download URL against the domain/IP list in
    the Falcon IOC Management CSV above
[ ] Run the endpoint sweep script in Playbook 3 (section 13) after any build
    from an unfamiliar or forked repository

Import note: Falcon IOC Management natively accepts sha256, md5, sha1, domain, ipv4 and ipv6. The CDP helper URLs are routed to your proxy/SWG rather than the Falcon IOC importer. The SSL certificate thumbprint is not a native Falcon IOC type — use it as a manual pivot/enrichment value against any TLS-inspection or JA3-capable network tooling you operate.

Gate 1 — Telemetry ready

• Confirm the macOS Falcon sensor is deployed and reporting ProcessRollup2/SyntheticProcessRollup2 for your Xcode developer population — this population is frequently under-sampled in fleet-wide sensor policy audits.
• Confirm DnsRequest and NetworkConnectIP4 are populated for macOS endpoints in your tenant; some macOS sensor policies reduce network telemetry by default.
• Confirm your sensor policy captures full CommandLine for macOS process events — Q6, Q7, Q8 and Q9 depend entirely on command-line visibility since macOS has no registry-equivalent event.

Gate 2 — Benign baseline

• Run Q3, Q5, Q6, Q7, Q8 and Q9 over 7 days with no exclusions and record hit counts against your developer and MDM populations before promoting any to alert.
• Q1, Q2 and Q4 should return zero in a clean environment. A non-zero baseline is itself a finding — investigate before assuming false positives.

Gate 3 — Positive tests

• In an isolated VM, launch Chrome with --remote-debugging-port=9222 and confirm Q3 fires; close it afterward.
• Run defaults write com.example.test.$(uuidgen) TestKey "$(head -c 300 /dev/urandom | base64)" and confirm Q6 fires; run defaults delete to clean up.
• Run tccutil reset All com.example.test against a harmless bundle ID and confirm Q7 fires.

Gate 4 — Promotion criteria

• Promote Q1, Q2 and Q4 to Custom IOA Block immediately — zero expected legitimate traffic.
• Promote Q3 and Q8 to Block only after 7 days at a confirmed, explainable FP rate against your CI/automation and MDM populations.
• Re-validate the 7 IPv4 indicators before any network block — they carry the shortest expiry and the highest reassignment risk in this pack.

1 — Enable Xcode User Script Sandboxing fleet-wide

Prerequisites: Xcode 15 or later on managed developer endpoints. Reboot required: No — takes effect on next Xcode build.

#!/bin/bash
# Enforces sandboxed Run Script build phases at the Xcode application level.
defaults write com.apple.dt.Xcode IDEBuildOperationDefaultBuildSetting_ENABLE_USER_SCRIPT_SANDBOXING -bool YES

# Verify
defaults read com.apple.dt.Xcode IDEBuildOperationDefaultBuildSetting_ENABLE_USER_SCRIPT_SANDBOXING

Rollback: defaults delete com.apple.dt.Xcode IDEBuildOperationDefaultBuildSetting_ENABLE_USER_SCRIPT_SANDBOXING

Some legacy build-phase scripts that reach outside their declared inputs/outputs (uncommon but not unheard of) will fail under sandboxing. Pilot on one developer ring before fleet-wide deployment.

2 — MDM configuration profile: enforce Gatekeeper + notarization

Prerequisites: MDM (Jamf Pro or equivalent) managing the target fleet. Reboot required: No — a re-login may be needed for the policy to take effect in already-running sessions.

<!-- Deploy via Jamf Pro (or your MDM) as a Custom Configuration Profile,
     PayloadType com.apple.systempolicy.control -->
<dict>
  <key>PayloadType</key>
  <string>com.apple.systempolicy.control</string>
  <key>EnableAssessment</key>
  <true/>
  <key>AllowIdentifiedDevelopers</key>
  <true/>
  <key>DisableOverride</key>
  <true/>
</dict>

# Verify (on target endpoint)
spctl --status

Rollback: Remove/unassign the configuration profile via MDM; Gatekeeper returns to its prior local-override state.

3 — Endpoint sweep for XCSSET v40 artifacts (read-only audit)

Prerequisites: None — read-only, safe on production endpoints. Reboot required: No.

#!/bin/bash
# READ-ONLY audit. Does not remediate. Review output before acting.

echo "--- Ad hoc-signed apps in /Applications ---"
for app in /Applications/*.app; do
  codesign -dv "$app" 2>&1 | grep -q "Authority=" || echo "UNSIGNED/AD-HOC: $app"
done

echo "--- Chrome launches with the CDP flag in the last hour ---"
log show --predicate 'eventMessage CONTAINS "remote-debugging-port"' --last 1h

echo "--- Preference domains modified in the last 24h (heuristic) ---"
find "$HOME/Library/Preferences" -name "*.plist" -mtime -1

echo "--- Telegram.app signature check ---"
if [ -d "/Applications/Telegram.app" ]; then
  codesign -dv "/Applications/Telegram.app" 2>&1
fi

Rollback: None required — this script performs no changes.

4 — Block known XCSSET v40 C2 infrastructure at the network layer

Prerequisites: Admin access to the macOS packet filter (pf) or equivalent network appliance. Reboot required: No.

# /etc/pf.anchors/xcsset-v40-block
block drop out quick on en0 to { 91.108.106.229 95.142.35.34 95.142.35.206 \
  95.142.37.159 151.243.109.188 178.208.92.129 178.208.92.168 }

# Load the anchor (add a matching anchor line in /etc/pf.conf first)
sudo pfctl -f /etc/pf.conf

# Verify
sudo pfctl -sr | grep -A2 xcsset

Rollback: Remove the anchor reference from /etc/pf.conf and the xcsset-v40-block file, then reload with sudo pfctl -f /etc/pf.conf.

This is host-level and does not scale past a handful of endpoints — for fleet enforcement, push the same block list to your perimeter firewall or DNS sinkhole instead.

Nine of sixteen mapped behaviors have good or partial CQL coverage and five are promoted to Custom IOAs. The residual gaps cluster in three places: in-memory tradecraft (boot module, VM evasion, screen/input capture — none produce discrete process telemetry by design), legacy capabilities not confirmed active in the v40 press coverage (Launch Daemon persistence, ransomware impact), and the propagation vector itself (git-based spread has no Falcon telemetry and is addressed only through source-control hygiene in section 7). Validation gates for every query are in section 11; clear Gate 1 before treating any zero-hit result as clean.

Provenance: the fetched text of all six sources is saved alongside this pack in XCSSET-v40-Hunt-sources/. Every atomic indicator in section 4/10 traces to the Unit 42 snapshot (01) and is cross-validated in snapshots 03 and 04.