XCSSET v4.0 resurfaces, weaponizing Xcode supply-chain attacks on macOS developers
After months dormant, XCSSET v40 returned with memory‑resident code, polymorphic payloads and file‑less persistence, making detection harder than ever. It spreads through compromised Xcode projects on GitHub, infecting thousands of macOS apps and stealing credentials. Unit 42 outlines its C2 rotation and offers concrete mitigation steps for developers.