Given the “toxica” + “xzip” combination, a plausible hypothesis is a repackaged with an XZip compression library side-loading attack.