Related Threat Clusters
-
MuddyWater Targets U.S. Entities Amid Geopolitical Tensions
In early 2026, the Iranian APT group MuddyWater launched cyberattacks against U.S. banking, a major airport, and Israeli operations of a U.S.-based software company. The attacks intensified in March, coinciding with…
16 articles · Updated July 22, 2026 -
XCSSET v40 Targets macOS Developers via Poisoned Xcode Projects
XCSSET v40 has emerged as a significant threat to macOS developers, utilizing poisoned Xcode projects to compromise local builds and execute supply chain attacks. This version can hijack Chrome and Trojanize Telegram…
3 articles · Updated August 3, 2026 -
XCSSET Malware Evolves with Enhanced Obfuscation and Persistence Techniques
The XCSSET malware has released a new variant, v40, targeting macOS systems and specifically infecting Xcode projects. This version employs advanced obfuscation techniques, including polymorphic payload generation and…
3 articles · Updated September 9, 2026 -
XCSSET Malware Targets macOS Developers Through Xcode Projects
The ADEX security team has published a case study on an active XCSSET malware infection affecting an iOS app development studio. XCSSET, a modular macOS malware identified in 2020, embeds itself in Xcode project files…
5 articles · Updated May 19, 2026
Recent Intelligence Reports
- September 2025 — www.microsoft.com · September 9, 2026
- New Xcsset Malware Adds New Obfuscation Persistence Techniques To Infect Xcode Projects — www.microsoft.com · September 9, 2026
- Xcsset V40 Malware Analysis — unit42.paloaltonetworks.com · September 9, 2026
- XCSSET v40 Abuses Chrome DevTools Protocol to Steal Cookies and Run Commands — Cybersecuritynews · August 3, 2026
- XCSSET v40 Infects Xcode Projects to Hijack Chrome and Trojanize Telegram on Macs — Gbhackers · August 3, 2026
- T1539 — attack.mitre.org · July 23, 2026
- Tracker — www.globenewswire.com · June 1, 2026
- Adex Publishes Analysis Of Xcsset Malware Research Details How Active Infection Spreads Silently Through Xcode Projects Github Repositories And Developer Credentials 302775907 — www.prnewswire.com · May 19, 2026