New XCSSET malware variant targets macOS developers via compromised

🚨 ACTIVE EXPLOITATION

• New XCSSET malware variant targets macOS developers via compromised Xcode projects XCSSET malware infects macOS developers through compromised Xcode projects and GitHub repositories.
  • Targets macOS developers using Xcode projects and GitHub repositories
  • Malware spreads by injecting downloader scripts into benign Xcode project files
  • Version 40 includes Chrome hijacker and Telegram trojanizer modules
  • Uses evasion techniques like loader recompilation, encryption, and macOS security disabling
  • Infection chain enables credential theft, keystroke logging, browser hijacking, and data exfiltration 📎 Coverage: bleepingcomputer.com · 👁 via BleepingComputer

💥 BREACHES & INCIDENTS

• Beacon CRM hacked, exposing contact data of multiple UK cultural and charity organisations Beacon CRM suffered a cyberattack exposing contact data of numerous cultural and charity organisations.

  • Applies to customers of Beacon CRM, including English National Ballet, Chiswick House and Gardens Trust, Centre for Sustainable Energy
  • Data exposed includes names, email addresses, business phone numbers, business addresses, donation dates and amounts
  • Attack involved unauthorized access via compromised credentials and likely downloading of database backups
  • No passwords, payment details, or bank account information were exposed
  • Incident discovered on July 29, 2026; forensic investigation and containment actions underway 📎 Coverage: artsprofessional.co.uk · 📄 Original: cse.org.uk · 👁 via @campuscodi@mastodon.social

• Coinkite halts Coldcard wallet sales after $100M theft via hardware exploit Hackers exploited a bug in Coinkite Coldcard hardware wallets to steal nearly $100 million.

  • Applies to Coinkite Coldcard hardware crypto wallets with vulnerable firmware
  • Attack exploited a firmware bug allowing theft of funds from offline wallets
  • Coinkite destroyed all remaining vulnerable Coldcard inventory and halted shipments
  • Patched firmware prevents new seeds from being compromised but not existing ones
  • Other wallets like SATSCARD, OPENDIME, and TAPSIGNER are unaffected 📎 Coverage: blog.coinkite.com · 📄 Original: blog.coinkite.com · 👁 via @campuscodi@mastodon.social

🕵️ RESEARCH & DEEP DIVES

• Smoke#Screen Campaign Uses ScreenConnect RMM for Persistent Phishing Attacks Attackers use phishing to deliver ScreenConnect RMM for persistent remote access.

  • Targets organizations using ScreenConnect Remote Monitoring and Management (RMM) tool
  • Employs diverse social engineering lures including fake Zoom and Adobe updates, document requests, and system maintenance prompts
  • Delivers rotating payloads such as VBScript droppers, batch loaders, .NET executables, and HTML phishing pages
  • Installs ScreenConnect agent silently to maintain legitimate-appearing remote access on Windows and macOS
  • Uses evasion techniques like Cloudflare tunnels, Dropbox, and ConnectWise-signed binaries to bypass detection 📎 Coverage: darkreading.com · 👁 via Dark Reading

• 77 Open VSX Extensions Impersonated Legitimate Tools to Harvest Developer Info 77 malicious Open VSX extensions harvested developer environment data.

  • Targets: Developers using Open VSX marketplace extensions
  • Malicious extensions impersonated legitimate tools with low version numbers (mostly 0.0.1)
  • Data exfiltration included system info, Git metadata, CI environment details, and workspace paths
  • Extensions communicated with mangorbit.com domains to send harvested data
  • No source code, credentials, or tokens were accessed, but extensive environment profiling was done 📎 Coverage: bleepingcomputer.com · 👁 via BleepingComputer

📌 OTHER

• Microsoft Defender isolates QNET endpoint in 128 seconds to stop ransomware attack Microsoft Defender automatically isolated a compromised QNET endpoint to stop a ransomware attack.
  • Applies to QNET, a global direct-selling company using Microsoft Defender with attack disruption enabled
  • Attack involved a multi-stage ransomware using living-off-the-land (LOL) techniques on a compromised Windows endpoint
  • Defender used new device isolation action to block all external network connectivity within 128 seconds
  • Isolation prevented second-stage payload persistence, lateral movement, credential theft, and data exfiltration
  • Device isolation is AI-driven, triggered at 99% confidence, and maintains access to security services during isolation 📎 Coverage: microsoft.com · 📄 Original: microsoft.com · 👁 via Microsoft Security Blog

🔓 CVEs & KEV

• Other: 20 CVEs (worst 8.2)

• us-water-systems-cyberattacks-2026 — @campuscodi@mastodon.social