Date: 08/03/2026
Severity: High
Summary
XCSSET v40 is an advanced macOS malware targeting Apple developers through Xcode supply chain attacks, infecting legitimate projects and propagating across all existing Xcode projects on compromised systems. The latest version employs fileless persistence, dynamic in-memory execution, polymorphic payloads, and multi-layered obfuscation to evade detection, while enabling credential theft, browser hijacking, clipboard monitoring, data exfiltration, and rotating C2 communications. Recent activity has particularly targeted developers in South Asia, highlighting the malware's continued evolution and expanding reach.
Indicators of Compromise (IOC) List
Domains/URLs | accapple.ru adschecks.ru adschecks.ru adsmobi.ru adsmorein.in adsmoreme.in amdcdn.ru amzndev.in amzndev.ru amznprod.in applecdn.ru appledisk.ru appledns.ru applehosts.ru appletime.in bulksec.ru cdnamz.in cdnamz.ru cdnapple.in cdnatapple.ru cdnroute.ru checkcdn.ru chromeads.ru cnmag.ru devnetaps.ru dnsapple.ru dnsrelays.ru explorecdn.ru fiddlejoy.ru figmacat.ru figmanets.in funchats.ru gironetcdn.ru goalmate.ru googlenets.ru greencn.ru icloudsnet.ru imails.ru legalads.in littleads.in littledns.ru maganet.ru mindelgate.ru netapsdev.ru netcdnads.in netcdnamz.ru netcdndev.in netcorps.ru netsprot.in netsproto.in networkads.in rigacdn.in rigmajoys.in rigmanet.ru rigmanets.in sahusuzuki.in stuffdns.in testjoys.ru timewebnet.in vigmanet.ru whitead.in whiteads.ru wincdn.ru windsecure.ru https://amzndev.in/d/zw_sfp64 https://amzndev.ru/d/zw_sfp64 https://googlenets.ru/d/zw_sfp64 https://netcdndev.in/d/zw_sfp64 https://whitead.in/d/zw_sfp64 https://whiteads.ru/d/zw_sfp64 |
IP Address | 91.108.106.229 95.142.35.34 95.142.35.206 95.142.37.159 151.243.109.188 178.208.92.129 178.208.92.168 |
Hash | 6e480d648fa1b70612f5d198a66875e28847547d
|
Gurucul Threat Detection and Incident Response (TDIR) Queries for Detection
Detection Query 1 : | domainname like "accapple.ru" or url like "accapple.ru" or siteurl like "accapple.ru" or domainname like "amzndev.ru" or url like "amzndev.ru" or siteurl like "amzndev.ru" or domainname like "googlenets.ru" or url like "googlenets.ru" or siteurl like "googlenets.ru" or domainname like "appledns.ru" or url like "appledns.ru" or siteurl like "appledns.ru" or domainname like "littleads.in" or url like "littleads.in" or siteurl like "littleads.in" or domainname like "netsprot.in" or url like "netsprot.in" or siteurl like "netsprot.in" or domainname like "littledns.ru" or url like "littledns.ru" or siteurl like "littledns.ru" or domainname like "applehosts.ru" or url like "applehosts.ru" or siteurl like "applehosts.ru" or domainname like "vigmanet.ru" or url like "vigmanet.ru" or siteurl like "vigmanet.ru" or domainname like "netcorps.ru" or url like "netcorps.ru" or siteurl like "netcorps.ru" or domainname like "amzndev.in" or url like "amzndev.in" or siteurl like "amzndev.in" or domainname like "cdnapple.in" or url like "cdnapple.in" or siteurl like "cdnapple.in" or domainname like "amdcdn.ru" or url like "amdcdn.ru" or siteurl like "amdcdn.ru" or domainname like "rigmajoys.in" or url like "rigmajoys.in" or siteurl like "rigmajoys.in" or domainname like "whitead.in" or url like "whitead.in" or siteurl like "whitead.in" or domainname like "dnsapple.ru" or url like "dnsapple.ru" or siteurl like "dnsapple.ru" or domainname like "https://googlenets.ru/d/zw_sfp64" or url like "https://googlenets.ru/d/zw_sfp64" or siteurl like "https://googlenets.ru/d/zw_sfp64" or domainname like "https://whitead.in/d/zw_sfp64" or url like "https://whitead.in/d/zw_sfp64" or siteurl like "https://whitead.in/d/zw_sfp64" or domainname like "devnetaps.ru" or url like "devnetaps.ru" or siteurl like "devnetaps.ru" or domainname like "amznprod.in" or url like "amznprod.in" or siteurl like "amznprod.in" or domainname like "netcdnamz.ru" or url like "netcdnamz.ru" or siteurl like "netcdnamz.ru" or domainname like "goalmate.ru" or url like "goalmate.ru" or siteurl like "goalmate.ru" or domainname like "testjoys.ru" or url like "testjoys.ru" or siteurl like "testjoys.ru" or domainname like "bulksec.ru" or url like "bulksec.ru" or siteurl like "bulksec.ru" or domainname like "https://netcdndev.in/d/zw_sfp64" or url like "https://netcdndev.in/d/zw_sfp64" or siteurl like "https://netcdndev.in/d/zw_sfp64" or domainname like "rigacdn.in" or url like "rigacdn.in" or siteurl like "rigacdn.in" or domainname like "cdnatapple.ru" or url like "cdnatapple.ru" or siteurl like "cdnatapple.ru" or domainname like "wincdn.ru" or url like "wincdn.ru" or siteurl like "wincdn.ru" or domainname like "adsmoreme.in" or url like "adsmoreme.in" or siteurl like "adsmoreme.in" or domainname like "icloudsnet.ru" or url like "icloudsnet.ru" or siteurl like "icloudsnet.ru" or domainname like "https://amzndev.ru/d/zw_sfp64" or url like "https://amzndev.ru/d/zw_sfp64" or siteurl like "https://amzndev.ru/d/zw_sfp64" or domainname like "adsmobi.ru" or url like "adsmobi.ru" or siteurl like "adsmobi.ru" or domainname like "adsmorein.in" or url like "adsmorein.in" or siteurl like "adsmorein.in" or domainname like "greencn.ru" or url like "greencn.ru" or siteurl like "greencn.ru" or domainname like "checkcdn.ru" or url like "checkcdn.ru" or siteurl like "checkcdn.ru" |
Detection Query 2 : | domainname like "netcdndev.in" or url like "netcdndev.in" or siteurl like "netcdndev.in" or domainname like "funchats.ru" or url like "funchats.ru" or siteurl like "funchats.ru" or domainname like "sahusuzuki.in" or url like "sahusuzuki.in" or siteurl like "sahusuzuki.in" or domainname like "figmacat.ru" or url like "figmacat.ru" or siteurl like "figmacat.ru" or domainname like "appledisk.ru" or url like "appledisk.ru" or siteurl like "appledisk.ru" or domainname like "mindelgate.ru" or url like "mindelgate.ru" or siteurl like "mindelgate.ru" or domainname like "netsproto.in" or url like "netsproto.in" or siteurl like "netsproto.in" or domainname like "timewebnet.in" or url like "timewebnet.in" or siteurl like "timewebnet.in" or domainname like "cdnamz.ru" or url like "cdnamz.ru" or siteurl like "cdnamz.ru" or domainname like "explorecdn.ru" or url like "explorecdn.ru" or siteurl like "explorecdn.ru" or domainname like "legalads.in" or url like "legalads.in" or siteurl like "legalads.in" or domainname like "https://amzndev.in/d/zw_sfp64" or url like "https://amzndev.in/d/zw_sfp64" or siteurl like "https://amzndev.in/d/zw_sfp64" or domainname like "gironetcdn.ru" or url like "gironetcdn.ru" or siteurl like "gironetcdn.ru" or domainname like "imails.ru" or url like "imails.ru" or siteurl like "imails.ru" or domainname like "rigmanets.in" or url like "rigmanets.in" or siteurl like "rigmanets.in" or domainname like "fiddlejoy.ru" or url like "fiddlejoy.ru" or siteurl like "fiddlejoy.ru" or domainname like "cdnroute.ru" or url like "cdnroute.ru" or siteurl like "cdnroute.ru" or domainname like "https://whiteads.ru/d/zw_sfp64" or url like "https://whiteads.ru/d/zw_sfp64" or siteurl like "https://whiteads.ru/d/zw_sfp64" or domainname like "cdnamz.in" or url like "cdnamz.in" or siteurl like "cdnamz.in" or domainname like "stuffdns.in" or url like "stuffdns.in" or siteurl like "stuffdns.in" or domainname like "netcdnads.in" or url like "netcdnads.in" or siteurl like "netcdnads.in" or domainname like "maganet.ru" or url like "maganet.ru" or siteurl like "maganet.ru" or domainname like "netapsdev.ru" or url like "netapsdev.ru" or siteurl like "netapsdev.ru" or domainname like "whiteads.ru" or url like "whiteads.ru" or siteurl like "whiteads.ru" or domainname like "windsecure.ru" or url like "windsecure.ru" or siteurl like "windsecure.ru" or domainname like "applecdn.ru" or url like "applecdn.ru" or siteurl like "applecdn.ru" or domainname like "cnmag.ru" or url like "cnmag.ru" or siteurl like "cnmag.ru" or domainname like "networkads.in" or url like "networkads.in" or siteurl like "networkads.in" or domainname like "rigmanet.ru" or url like "rigmanet.ru" or siteurl like "rigmanet.ru" or domainname like "adschecks.ru" or url like "adschecks.ru" or siteurl like "adschecks.ru" or domainname like "chromeads.ru" or url like "chromeads.ru" or siteurl like "chromeads.ru" or domainname like "appletime.in" or url like "appletime.in" or siteurl like "appletime.in" or domainname like "figmanets.in" or url like "figmanets.in" or siteurl like "figmanets.in" or domainname like "dnsrelays.ru" or url like "dnsrelays.ru" or siteurl like "dnsrelays.ru" |
Detection Query 3 : | dstipaddress IN ("91.108.106.229","178.208.92.129","95.142.35.34","151.243.109.188","95.142.37.159","178.208.92.168","95.142.35.206") or srcipaddress IN ("91.108.106.229","178.208.92.129","95.142.35.34","151.243.109.188","95.142.37.159","178.208.92.168","95.142.35.206") |
Detection Query 4 : | sha1hash IN ("6e480d648fa1b70612f5d198a66875e28847547d")
|
Reference:
https://unit42.paloaltonetworks.com/xcsset-v40-malware-analysis/