XCSSET is macOS malware that spreads through Xcode projects: when a developer builds an infected project, it runs and can steal browser data, notes and crypto wallet data. If you build projects you didn't write, inspect their build phases and scripts first, and check ~/.zshrc and your Dock for changes you didn't make.
Last reviewed · 3 sources
Also known as: OSX.XCSSET, Xcode Malware
Trend Micro described XCSSET in August 2020: it inserts code into local Xcode projects so the payload runs when the project builds, and it can hijack Safari and inject JavaScript into web pages. In March 2025 Microsoft reported its first new variant since 2022, with more obfuscation, new ways of infecting projects, and two new persistence methods: one adds itself to the zsh shell's startup file, the other swaps in a fake Launchpad in the Dock. It steals files and system and user information such as digital wallet data and notes.
Infected Xcode projects shared on GitHub and between developers
A malicious step added to a project's build settings that runs when you build
Projects passed around as if they were legitimate tools or samples
Build phases or scripts in an .xcodeproj file that you didn't add
New lines in ~/.zshrc you didn't write
A Launchpad item in the Dock that behaves differently or points somewhere new
Safari extensions or settings you didn't change
Check the build phases and run scripts in each project, especially ones you cloned or were sent. Compare .xcodeproj files against a clean copy in version control.
Remove injected build steps and related files, or restore the project from a commit made before the infection.
Open ~/.zshrc in a text editor and remove lines you didn't add. Remove any Launchpad item from the Dock that you didn't put there; up to macOS 15 the real one is /System/Applications/Launchpad.app, and macOS 26 replaced Launchpad with the Apps app.
Remove Safari extensions you don't recognize, and check ~/Library/LaunchAgents for new entries.
From another device, change passwords for accounts you used in Safari, and move crypto to new wallets.
Read a shared or forked Xcode project's build phases before you build it
Use git diff to review changes to .xcodeproj files before committing
Treat repositories that imitate popular tools with caution
Keep build machines separate from wallets and personal accounts where you can
What it can and can't do
CoreLock doesn't inspect Xcode projects, ~/.zshrc or the Dock, which is where XCSSET hides, so the manual checks above matter most. Its free scan's startup-items check covers launch items, and it can't promise to catch every variant.
Trojan — Silver Sparrow is an activity cluster Red Canary reported in February 2021. Its ...
Trojan — Lazarus Group is a North Korean state-sponsored group attributed to the Reconnai...
Trojan — Jamf Threat Labs described RustBucket in April 2023 and suspects a North Korean ...
Your risk is low if you don't use Xcode or build other people's code. XCSSET runs when an infected Xcode project is built, so it reaches developers first.
It adds its own step to a project's build settings, so the payload runs when the project is compiled. The change stays in the project, so anyone who builds a shared copy runs it too. Microsoft's 2025 variant picks among several strategies for where to insert itself.
Trend Micro found it could hijack Safari and inject JavaScript into web pages. Microsoft's 2025 analysis says the new variant steals files and system and user information, such as digital wallet data and notes.
Free, with no account: the scan checks your Downloads folder against a built-in malware-hash list and 19 YARA rules.
Apple silicon build 2.0.7 · Intel Mac?
For your Mac, not this phone ·
Count which apps can record your screen, use your mic or camera, or read your files, and get a free 0–100 estimate in your browser.
Estimate your Security ScoreFree · Calculated in your browser