The xpub, or extended public key, is used to derive all addresses in an account. In multisig, a threshold and one xpub per cosigner are combined to generate multisig addresses. If xpubs are not verified properly, an attacker can swap them, leading to potential theft or ransom attacks.