[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fJeTr8HyVreRb-8WWq4AZ8_id8Wu-Lg31uzkKcY73S9I":3},{"article":4,"iocs":54,"watch_terms":89,"solutions":90,"lesson":186},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"a464451f-2708-4db7-9217-256dd66d31ee","New XCSSET variant targets macOS devs via compromised Xcode projects","new-xcsset-variant-targets-macos-devs-via-compromised-xcode-projects-836ef3","A new version of the XCSSET malware is targeting thousands of macOS users through compromised Xcode projects and GitHub repositories. [...]","A new version of the XCSSET malware, v40, is targeting macOS developers by compromising Xcode projects and GitHub repositories. The malware injects downloader scripts into project files, infecting developers when they build the projects. It then spreads to other projects on the system and deploys modules for credential theft, keystroke logging, and browser hijacking, including a new Chrome hijacker and Telegram trojanizer.","New XCSSET malware variant targets macOS developers via compromised Xcode projects.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fnew-xcsset-variant-targets-macos-devs-via-compromised-xcode-projects\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2026\u002F05\u002F18\u002FApple.jpg","2026-08-04T19:03:09+00:00","2026-08-04T20:00:12.046578+00:00",8,[17,20,22,24,27,29],{"name":18,"type":19},"Xcode","product",{"name":21,"type":19},"Chrome",{"name":23,"type":19},"Telegram Desktop",{"name":25,"type":26},"Apple","vendor",{"name":28,"type":26},"Microsoft",{"name":30,"type":26},"Google","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":31,"icon":33,"name":34,"slug":35},null,"Malware","malware",[37,42,44,49],{"category":38},{"id":39,"icon":33,"name":40,"slug":41},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":43},{"id":31,"icon":33,"name":34,"slug":35},{"category":45},{"id":46,"icon":33,"name":47,"slug":48},"ade75414-7914-4e23-a450-48b64546ee70","Open Source","open-source",{"category":50},{"id":51,"icon":33,"name":52,"slug":53},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[55,58,62,65,68,71,74,77,80,83,86],{"type":35,"value":56,"context":57},"XCSSET","Name of the malware variant discussed in the article.",{"type":59,"value":60,"context":61},"mitre_attack","T1059.004","AppleScript activity, potentially related to XCSSET's infection chain.",{"type":59,"value":63,"context":64},"T1059.007","Fileless reverse shell, mentioned in relation to Chrome hijacker.",{"type":59,"value":66,"context":67},"T1555","Credential theft capabilities of XCSSET.",{"type":59,"value":69,"context":70},"T1113","Keystroke logging capabilities of XCSSET.",{"type":59,"value":72,"context":73},"T1115","Clipboard manipulation capabilities of XCSSET.",{"type":59,"value":75,"context":76},"T1185","Browser hijacking capabilities of XCSSET.",{"type":59,"value":78,"context":79},"T1071.001","Web traffic interception and manipulation for credential\u002Fpayment theft.",{"type":59,"value":81,"context":82},"T1041","Exfiltration of stolen data.",{"type":59,"value":84,"context":85},"T1027","Obfuscation of function names, variables, and strings.",{"type":59,"value":87,"context":88},"T1562.001","Disabling macOS security features like XProtect and MRT.",[25,28,30],{"controls":91,"vendors":174},[92,121,145],{"slug":93,"name":94,"problem":95,"products":96},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[97,105,113],{"vendor_slug":98,"vendor_name":99,"vendor_logo":100,"product_slug":101,"product_name":102,"url":103,"description":104},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-edr","Huntress Managed EDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-edr","Endpoint detection and response monitored around the clock by Huntress analysts.",{"vendor_slug":106,"vendor_name":107,"vendor_logo":108,"product_slug":109,"product_name":110,"url":111,"description":112},"sophos","Sophos","\u002Fvendor-logos\u002Fsophos.png","sophos-endpoint","Sophos Endpoint","https:\u002F\u002Fwww.sophos.com\u002Fen-us\u002Fproducts\u002Fendpoint-security","Endpoint protection with Intercept X anti-ransomware technology and EDR.",{"vendor_slug":114,"vendor_name":115,"vendor_logo":116,"product_slug":117,"product_name":118,"url":119,"description":120},"elastic","Elastic","\u002Fvendor-logos\u002Felastic.png","elastic-security","Elastic Security","https:\u002F\u002Fwww.elastic.co\u002Fsecurity","SIEM and endpoint security built on Elasticsearch, with open detection rules.",{"slug":122,"name":123,"problem":124,"products":125},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",[126,133,138],{"vendor_slug":127,"vendor_name":128,"vendor_logo":129,"product_slug":127,"product_name":130,"url":131,"description":132},"sosafe","SoSafe","\u002Fvendor-logos\u002Fsosafe.png","SoSafe Awareness Platform","https:\u002F\u002Fsosafe-awareness.com\u002F","Behaviour-based awareness training and phishing simulation in many languages.",{"vendor_slug":98,"vendor_name":99,"vendor_logo":100,"product_slug":134,"product_name":135,"url":136,"description":137},"managed-sat","Huntress Managed Security Awareness Training","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fsecurity-awareness-training","Security awareness training and phishing simulation, managed for you.",{"vendor_slug":139,"vendor_name":140,"vendor_logo":141,"product_slug":122,"product_name":142,"url":143,"description":144},"knowbe4","KnowBe4","\u002Fvendor-logos\u002Fknowbe4.png","KnowBe4 Security Awareness Training","https:\u002F\u002Fwww.knowbe4.com\u002Fproducts\u002Fsecurity-awareness-training","Training library and simulated phishing with reporting.",{"slug":146,"name":147,"problem":148,"products":149},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship.",[150,158,166],{"vendor_slug":151,"vendor_name":152,"vendor_logo":153,"product_slug":154,"product_name":155,"url":156,"description":157},"snyk","Snyk","\u002Fvendor-logos\u002Fsnyk.png","snyk-open-source","Snyk Open Source","https:\u002F\u002Fsnyk.io\u002Fproduct\u002Fopen-source-security-management\u002F","Finds and fixes vulnerable open-source dependencies in code and pipelines.",{"vendor_slug":159,"vendor_name":160,"vendor_logo":161,"product_slug":162,"product_name":163,"url":164,"description":165},"github","GitHub","\u002Fvendor-logos\u002Fgithub.png","advanced-security","GitHub Advanced Security","https:\u002F\u002Fgithub.com\u002Fsecurity\u002Fadvanced-security","Dependency review, code scanning and secret scanning with push protection.",{"vendor_slug":167,"vendor_name":168,"vendor_logo":169,"product_slug":170,"product_name":171,"url":172,"description":173},"jfrog","JFrog","\u002Fvendor-logos\u002Fjfrog.png","jfrog-curation","JFrog Curation","https:\u002F\u002Fjfrog.com\u002Fcuration\u002F","Blocks malicious and risky open-source packages before they enter your repositories.",[175,180],{"slug":176,"name":25,"logo_path":177,"roles":178},"apple","\u002Fvendor-logos\u002Fapple.png",[179],"affected",{"slug":181,"name":182,"logo_path":183,"roles":184},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png",[185],"reported_by",{"slug":187,"title":188,"body":189,"framework_refs":190,"framework_notes":201},"xcsset-malware-targets-macos-devs-through-poisoned-xcode-projects","XCSSET Malware Targets macOS Devs Through Poisoned Xcode Projects","The XCSSET v40 malware exploits the trust developers place in shared Xcode projects and GitHub repositories, injecting malicious downloader scripts that execute silently during normal build processes. This is a classic supply chain attack — the developer becomes both victim and unwitting distributor, spreading the malware to every other project on their system. Once active, the malware harvests credentials, logs keystrokes, and hijacks browsers, meaning a single compromised repository can cascade into widespread data theft. This attack matters because developers often have elevated privileges and access to sensitive codebases, CI\u002FCD pipelines, and production secrets, making them high-value targets.",[191,192,193,194,195,196,197,198,199,200],"CIS Control 2: Inventory and Control of Software Assets","CIS Control 4: Secure Configuration of Enterprise Assets","CIS Control 16: Application Software Security","NIST SP 800-161: Cyber Supply Chain Risk Management","NIST SP 800-218: Secure Software Development Framework (SSDF) — PW.1, PW.4","NIST CSF: ID.SC-3 (Supply Chain Risk Management)","NIST CSF: DE.CM-4 (Malicious Code Detection)","MITRE ATT&CK: T1195.001 – Compromise Software Dependencies and Development Tools","MITRE ATT&CK: T1059 – Command and Scripting Interpreter","ISO\u002FIEC 27001: A.12.2 (Protection from Malware), A.14.2 (Security in Development and Support Processes)",{}]