[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fTXSqjnhYXNPdabTX8BvJ-6EHDlCarKTQwEBqkTIf8FI":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":22,"status":23,"created_at":24,"published_at":25,"article":26,"tags":30,"podcasts":49,"controls":50},"667f88a0-3312-4d52-84fd-5eeb50171f50","xcsset-malware-targets-macos-devs-through-poisoned-xcode-projects","a464451f-2708-4db7-9217-256dd66d31ee","XCSSET Malware Targets macOS Devs Through Poisoned Xcode Projects","The XCSSET v40 malware exploits the trust developers place in shared Xcode projects and GitHub repositories, injecting malicious downloader scripts that execute silently during normal build processes. This is a classic supply chain attack — the developer becomes both victim and unwitting distributor, spreading the malware to every other project on their system. Once active, the malware harvests credentials, logs keystrokes, and hijacks browsers, meaning a single compromised repository can cascade into widespread data theft. This attack matters because developers often have elevated privileges and access to sensitive codebases, CI\u002FCD pipelines, and production secrets, making them high-value targets.","**Immediate actions:**\n- Audit all locally cloned Xcode projects and GitHub repositories for unexpected or obfuscated build phase scripts before running any builds.\n- Scan developer workstations with an updated macOS-capable endpoint detection tool to identify existing XCSSET infections.\n- Revoke and rotate any credentials, API keys, or tokens stored on potentially compromised developer machines.\n\n**Long-term improvements:**\n- Implement code signing and integrity verification for all internal and third-party Xcode projects before they are used in builds.\n- Enforce a policy requiring peer review of build scripts and pre\u002Fpost-action phases in Xcode project files before merging to shared repositories.\n- Adopt a software composition analysis (SCA) tool in CI\u002FCD pipelines to detect unexpected or malicious script injections automatically.\n\n**Detection measures:**\n- Enable macOS Endpoint Detection & Response (EDR) logging to alert on anomalous script execution triggered by Xcode build processes.\n- Monitor GitHub repository activity for unexpected commits or modifications to `.xcodeproj` files, particularly those involving build phase scripts.\n- Use network monitoring to detect unusual outbound connections originating from Xcode or developer toolchain processes.",[12,13,14,15,16,17,18,19,20,21],"CIS Control 2: Inventory and Control of Software Assets","CIS Control 4: Secure Configuration of Enterprise Assets","CIS Control 16: Application Software Security","NIST SP 800-161: Cyber Supply Chain Risk Management","NIST SP 800-218: Secure Software Development Framework (SSDF) — PW.1, PW.4","NIST CSF: ID.SC-3 (Supply Chain Risk Management)","NIST CSF: DE.CM-4 (Malicious Code Detection)","MITRE ATT&CK: T1195.001 – Compromise Software Dependencies and Development Tools","MITRE ATT&CK: T1059 – Command and Scripting Interpreter","ISO\u002FIEC 27001: A.12.2 (Protection from Malware), A.14.2 (Security in Development and Support Processes)",{},"published","2026-08-04T20:20:20.339902+00:00","2026-08-04T20:20:20.234+00:00",{"id":7,"url":27,"slug":28,"title":29},"https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fnew-xcsset-variant-targets-macos-devs-via-compromised-xcode-projects\u002F","new-xcsset-variant-targets-macos-devs-via-compromised-xcode-projects-836ef3","New XCSSET variant targets macOS devs via compromised Xcode projects",[31,37,43],{"id":32,"name":33,"slug":34,"description":35,"color":36},"7261eb8f-acd4-4d93-a489-7fdd652ec0ea","Security Awareness","security-awareness","Phishing, social engineering, human error","#22c55e",{"id":38,"name":39,"slug":40,"description":41,"color":42},"859cf0ad-a7e9-42bb-a75d-bac6511fa5d5","Configuration Management","configuration-management","Misconfigs, default credentials, exposed services","#eab308",{"id":44,"name":45,"slug":46,"description":47,"color":48},"f0c2a0af-58aa-4128-87c9-6acd30f2dc48","Supply Chain","supply-chain","Third-party risk, compromised dependencies","#8b5cf6",[],[51,55,59],{"slug":52,"name":53,"problem":54},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",{"slug":56,"name":57,"problem":58},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",{"slug":60,"name":61,"problem":62},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship."]