A Chinese coworker sent me this link this morning, but HN said it had already been submitted (but I couldn't find it): http://researchcenter.paloaltonetworks.co

A Chinese coworker sent me this link this morning, but HN said it had already been submitted (but I couldn't find it): http://researchcenter.paloaltonetworks.com/2015/09/novel-malware-xcodeghost-modifies-xcode-infects-apple-ios-apps-and-hits-app-store/ http://researchcenter.paloaltonetworks.com/2015/09/novel-mal... If you're going to target developers, I'd think their keychain contents would be valuable too. Grab their Apple account credentials and their signing credentials. Have Xcode phone home, and custom craft a payload for their app.