XCSSET v40: Chrome DevTools Protocol Attack Exposed

**XCSSET v40** is an advanced macOS malware campaign distributed via malicious Xcode projects that targets developers and enables software supply‑chain compromise; it uses fileless execution, encrypted and polymorphic payloads, and abuses the Chrome DevTools Protocol to steal browser cookies/passwords, hijack sessions, manipulate cryptocurrency transactions, and provide a fileless reverse shell—researchers observed active activity in April–May 2026 and have published IoCs and mitigations.