New XCSSET macOS malware variant used in limited attacks

Microsoft Threat Intelligence identified a new variant of the macOS XCSSET malware used in limited real-world attacks. The variant increases payload obfuscation by randomizing encoding methods (including Base64 and xxd), obfuscates module names, adds new persistence methods (creating zshrc launch files and replacing a Launchpad app), and introduces multiple mechanisms to implant payloads into Xcode projects; Microsoft Defender for Endpoint detects XCSSET and users are advised to verify Xcode projects and install apps only from trusted sources.