XCSSET adds malicious code to a host's Xcode projects by enumerating CocoaPods "target_integrator.rb" files under the "/Library/Ruby/Gems" folder or enumerates all ".xcodeproj" folders under a given directory. XCSSET then downloads a script and Mach-O file into the Xcode project folder.