KEkekub·Sep 21, 2015Submission
Source code of the modified iOS SDK contained in “XcodeGhost” malware
1 points · Open discussionXcodeGhostSource
XcodeGhost
Objective-C2015–2015
XcodeGhostSource / XcodeGhost
XcodeGhost
"XcodeGhost" Source
7Distinct people
7Mentions
0Explicit recommenders
1.9KGitHub stars
What to know before exploring
What it is
"XcodeGhost" Source
GitHub
Where it is used
No documented product use has been verified yet.
What people are saying
No recommendation phrase was found in the indexed comments.
No classified warning is attached to this page. Read the discussions before treating silence as approval.
Also in these discussions
No other repository is repeatedly linked in the same discussions.
This week on Hacker News
Nov 7–Nov 14 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/14/2026, 11:56:56 AM UTC.
No direct repository links were found in the indexed HN discussions over the past seven days. Older discussions are available below.
Mentions over time
HN mentions by 3-hour interval7 dated mentions
Observed mentions: 2015-09-19 01:50:02 UTC to 2015-09-21 09:36:29 UTC.
Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.
View mention counts and date ranges
| Period | Start (UTC) | End (exclusive, UTC) | Mentions | Submissions | Comments |
|---|---|---|---|---|---|
| Sep 19, 00:00 | 2015-09-19 00:00:00 UTC | 2015-09-19 03:00:00 UTC | 1 | 1 | 0 |
| Sep 19, 03:00 | 2015-09-19 03:00:00 UTC | 2015-09-19 06:00:00 UTC | 2 | 0 | 2 |
| Sep 19, 06:00 | 2015-09-19 06:00:00 UTC | 2015-09-19 09:00:00 UTC | 2 | 0 | 2 |
| Sep 19, 09:00 | 2015-09-19 09:00:00 UTC | 2015-09-19 12:00:00 UTC | 1 | 0 | 1 |
| Sep 19, 12:00 | 2015-09-19 12:00:00 UTC | 2015-09-19 15:00:00 UTC | 0 | 0 | 0 |
| Sep 19, 15:00 | 2015-09-19 15:00:00 UTC | 2015-09-19 18:00:00 UTC | 0 | 0 | 0 |
| Sep 19, 18:00 | 2015-09-19 18:00:00 UTC | 2015-09-19 21:00:00 UTC | 0 | 0 | 0 |
| Sep 19, 21:00 | 2015-09-19 21:00:00 UTC | 2015-09-20 00:00:00 UTC | 0 | 0 | 0 |
| Sep 20, 00:00 | 2015-09-20 00:00:00 UTC | 2015-09-20 03:00:00 UTC | 0 | 0 | 0 |
| Sep 20, 03:00 | 2015-09-20 03:00:00 UTC | 2015-09-20 06:00:00 UTC | 0 | 0 | 0 |
| Sep 20, 06:00 | 2015-09-20 06:00:00 UTC | 2015-09-20 09:00:00 UTC | 0 | 0 | 0 |
| Sep 20, 09:00 | 2015-09-20 09:00:00 UTC | 2015-09-20 12:00:00 UTC | 0 | 0 | 0 |
| Sep 20, 12:00 | 2015-09-20 12:00:00 UTC | 2015-09-20 15:00:00 UTC | 0 | 0 | 0 |
| Sep 20, 15:00 | 2015-09-20 15:00:00 UTC | 2015-09-20 18:00:00 UTC | 0 | 0 | 0 |
| Sep 20, 18:00 | 2015-09-20 18:00:00 UTC | 2015-09-20 21:00:00 UTC | 0 | 0 | 0 |
| Sep 20, 21:00 | 2015-09-20 21:00:00 UTC | 2015-09-21 00:00:00 UTC | 0 | 0 | 0 |
| Sep 21, 00:00 | 2015-09-21 00:00:00 UTC | 2015-09-21 03:00:00 UTC | 0 | 0 | 0 |
| Sep 21, 03:00 | 2015-09-21 03:00:00 UTC | 2015-09-21 06:00:00 UTC | 0 | 0 | 0 |
| Sep 21, 06:00 | 2015-09-21 06:00:00 UTC | 2015-09-21 09:00:00 UTC | 0 | 0 | 0 |
| Sep 21, 09:00 | 2015-09-21 09:00:00 UTC | 2015-09-21 12:00:00 UTC | 1 | 1 | 0 |
What Hacker News says
7 sourcesDifferent email address it seems.
https://github.com/XcodeGhostSource/XcodeGhost/commit/e5b527...
https://github.com/XcodeGhostSource/XcodeGhost/commit/014f78...
In Popular Chinese iOS apps compromised in malware attackI can now see that the developers of WeChat Tencent have acknowledge that a release of theirs has been infected:
http://security.tencent.com/index.php/blog/msg/96
Wrt. to this github:
https://github.com/XcodeGhostSource/XcodeGhost
As far as I can see what this code does is that it sends some basic user information to an external website and it may popup an alert window or open Safari or other apps based on the response of that external website.
It is not a compiler virus and there is nothing on how you can modify an XCode release to add the above into other developers' apps.
In Popular Chinese iOS apps compromised in malware attackIt's true and if you read Chinese, it is already all over the Internet.
On twitter, most of them are under #XcodeGhost[0].
Besides, the (alleged) author has put the source code on github[1].
0. https://twitter.com/hashtag/XcodeGhost?src=hash
1. https://github.com/XcodeGhostSource/XcodeGhost
Update 1: Add the source code of XcodeGhost
In Popular Chinese iOS apps compromised in malware attackI find it interesting that the source code on GitHub was committed by 2 different users with the same user name XcodeGhostSource, one for the code and one for the README.md. Are these two separate persons? Or maybe the one for the code was committed before using the same email to register GitHub account?
https://github.com/XcodeGhostSource/XcodeGhost/commits/maste...
In Popular Chinese iOS apps compromised in malware attack@XcodeGhostSource on GitHub claims to be the author of the malware and open-sourced it and apologizes.
"XcodeGhost" Source: https://github.com/XcodeGhostSource/XcodeGhost
In Popular Chinese iOS apps compromised in malware attack