XOR, or exclusive OR, is a simple bitwise operation that compares two values and returns 1 only when they differ. It is reversible: applying the same XOR key twice restores the original data. That makes it easy to use for lightweight encoding, key mixing, and obfuscation.
In cyber security, XOR matters because malware often uses it to hide strings, configuration data, or small payload fragments from basic static inspection. It does not provide real cryptographic protection, but it can defeat quick searches for readable text and slow down analysts. Defenders often recognize XOR by repeated byte patterns, short decode loops, or cleartext appearing only after execution. Malware analysts then reconstruct the key or emulate the code to recover hidden indicators.