XCSSET Mac Malware: Infects Xcode Projects, Uses 0Days

This report describes the XCSSET macOS campaign that injects malicious code into Xcode projects so builds execute malware which drops backdoors and infostealers; the attackers used two zero-day exploits (cookie theft via a Data Vaults flaw and a Safari development UXSS) to steal credentials, inject JavaScript into websites, exfiltrate files, capture screenshots, and optionally encrypt files for ransom. The threat spreads via compromised developer projects (including GitHub repositories) creating a supply-chain-like risk, and the report includes multiple IoCs (SHA256 hashes, filenames, domains, and an IP) and mitigation recommendations.