New XCSSET malware adds new obfuscation, persistence techniques to infect Xcode projects

Microsoft Threat Intelligence describes a new modular XCSSET macOS malware variant that infects Xcode projects and uses multi-stage obfuscated shell and AppleScript payloads to establish persistence (zshrc, fake Launchpad via Dock, Git pre-commit), steal data (browser wallet extensions, Notes, system/browser info), and download additional modules from active C2 domains; the blog provides technical analysis of stages and submodules, IOCs, MITRE ATT&CK mappings, hunting queries, and mitigation recommendations.