Advanced Mobile Malware Campaign in India uses Malicious MDM
Summary: Cisco Talos identified a campaign against 13 iPhones in India in which the attacker used an open-source mobile device management system to deploy five applications, including modified versions of WhatsApp and Telegram built with the BOptions sideloading technique to inject a dynamic library. Server logs and command-and-control records show the malware was in use since August 2015, with data sent to techwach[.]com, and testing devices named "Test" and "mdmdev" carrying an Indian Vodafone India number led Talos to assess with high confidence that the author works from India.
What's compelling: Accepting an MDM certificate is equivalent to granting someone administrator access to the device and its passwords, and this actor held that access across 13 devices for roughly three years without detection, largely because the target count was so small.
Read the original at Cisco Talos ↗
- Topics
- Phishing & Social Engineering
- Related
- US disrupts North Korean campaign behind $400 million crypto theft Cyber Risks · Nov 14, 2026North Korea ‘s Crypto Theft Operations: DOJ Seizes $1.2 Billion and Disrupts Hacker Infrastructure Cyber Risks · Nov 13, 2026FBI Says North Korean Hackers Stole Over $400 Million in Crypto Using Deepfake Video Calls Cyber Risks · Nov 13, 2026