Forest Global Training Partners

Cyber Risks · Cisco Talos

Checkrain fake iOS jailbreak leads to click fraud

Summary: Cisco Talos found a malicious site, checkrain[.]com, impersonating the checkra1n jailbreak and installing a mobileconfig profile that uses Apple Web Clip to load a fake jailbreak page and funnel users through ad-tracking and verification redirects into click fraud ending in an iOS game install. The site claimed to work with researchers CoolStar and Ian Beer, cited the A13 chipset even though checkm8 only affects A5 to A11 devices, and drew traffic from the U.S., U.K., France, Nigeria, Iraq, Vietnam, Venezuela, Egypt, Georgia, Australia, Canada, Turkey, Netherlands and Italy.

Why it matters: The payload was a configuration profile, not an app, so the user's own trust in a jailbreak tool did the work no exploit needed to do. The campaign's endpoint was revenue from a slot machine game called POP! Slots, with users told to play for seven days to complete an unlock that does not exist.

Read the original at Cisco Talos ↗

Topics
Malware
Related