Hackers use macOS extended file attributes to hide malicious code

You can also use resource forks to change an app bundle's icon without affecting the code signature of the bundle. I used this technique for a PoC malware challenge at BSides Orlando two years back.