XCSSET v40: Short-Lived /tmp/p.app AppleScript Loader Execution with Create/Delete Correlation

Duo Tech@duotech

•updated Jul 31, 2026•1•0•4

Detects short-lived execution of the compiled AppleScript loader from /tmp/p.app, correlated with its rapid creation-then-deletion pattern, the observable proxy for XCSSET's dual-key-encrypted loader architecture.