New XCSSET variant targets macOS devs via compromised Xcode projects

The XCSSET v40 malware exploits the trust developers place in shared Xcode projects and GitHub repositories, injecting malicious downloader scripts that execute silently during normal build processes. This is a classic supply chain attack — the developer becomes both victim and unwitting distributor, spreading the malware to every other project on their system. Once active, the malware harvests credentials, logs keystrokes, and hijacks browsers, meaning a single compromised repository can cascade into widespread data theft. This attack matters because developers often have elevated privileges and access to sensitive codebases, CI/CD pipelines, and production secrets, making them high-value targets.