XCSSET Xcode Build-Trigger Beacon: curl GET /a?p=xcode_phase from build script

Duo Tech@duotech

•updated Jul 31, 2026•0•0•6

Detects an Xcode project or Git repository build-phase/pre-commit hook triggering an initial C2 beacon via curl GET /a?p=xcode_phase to retrieve the next infection stage.