Malicious MDM: Let's Hide This App
Summary: Cisco Talos found that attackers enrolled iPhones into a malicious MDM and pushed a profile setting the age rating limit to 9-plus, which made legitimate WhatsApp and Telegram apps disappear from the device while remaining installed. The attackers then pushed malicious versions of WhatsApp, Telegram, Imo and Safari to the enrolled phones, using only legitimate device administration with no malware, vulnerability or zero-day, tested on an iPhone X running iOS 11.4.1.
Why it matters: The restriction showed as 'disabled' in grey text on the device even though it was active, and an MDM-deployed profile leaves no entry under Settings > General > Profile - so a user checking their own phone can see nothing wrong while a fake WhatsApp sits where the real one used to be.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026