Black & White Path

Aug 5, 2026 · Information Security

macOS Developers Targeted as XCSSET v40 Poisons Xcode Projects, Hits Major Companies

The Unit 42 team details how the XCSSET v40 macOS trojan resurfaces by compromising Xcode projects through a four‑stage supply‑chain attack, adding Chrome hijack and Telegram trojan modules, employing advanced evasion techniques, and offering concrete mitigation steps for developers and security teams.