The Threat Intelligence Research That Mattered to You This Year
Summary: Unit 42's 2015 threat research covered XcodeGhost, which modified Xcode to infect popular iOS apps including WeChat and could phish passwords and open URLs through them, and KeyRaider, an iOS malware family believed to be the largest known Apple account theft, taking over 225,000 valid Apple accounts plus thousands of certificates, private keys, and purchasing receipts. The team also documented YiSpecter, the first malware seen in the wild abusing private iOS APIs and affecting both jailbroken and non-jailbroken devices, the Android Installer Hijacking vulnerability estimated to impact 49.5 percent of Android users, the Lotus Blossom espionage campaign with over 50 attacks against Southeast Asian government and military organizations over three years, and the BackStab attack that steals data from mobile backup files.
Bottom line: YiSpecter showed that non-jailbroken devices were no longer a safe assumption, and Android Installer Hijacking put an estimated 49.5 percent of Android users at risk through third-party app stores alone. Lotus Blossom's three years and 50-plus attacks, including one against a French Ministry of Foreign Affairs employee, show how long a patient espionage campaign can run before it is named.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Zero-Days & Exploits
- Related
- New Sign Drop Exploit Can Abuse Windows Defender to Bypass Security Protections Cyber Risks · Nov 13, 2026New Sign Drop Zero-Day Exploit Turns Windows CLFS Security Feature Into SYSTEM Access Cyber Risks · Nov 12, 2026November Patch Tuesday: An Overflowing Cornucopia of CVEs Cyber Risks · Nov 10, 2026