Back Stab: Mobile Backup Data Under Attack from Malware
Summary: Unit 42 identified 704 samples across six Trojan, adware and HackTool families for Windows and Mac OS X that steal private mobile device data by accessing local backup files stored on PCs and Macs. The technique, which Unit 42 calls the BackStab attack, has been in the wild for over five years and observed in more than 30 countries.
Why it matters: When users accept default backup options, the contents of an iOS device are stored unencrypted in a well-known location on the local hard drive, so malware on an ordinary PC or Mac can lift nearly all of a phone's private data without ever touching the phone itself.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Zero-Days & Exploits
- Related
- New Sign Drop Exploit Can Abuse Windows Defender to Bypass Security Protections Cyber Risks · Nov 13, 2026New Sign Drop Zero-Day Exploit Turns Windows CLFS Security Feature Into SYSTEM Access Cyber Risks · Nov 12, 2026November Patch Tuesday: An Overflowing Cornucopia of CVEs Cyber Risks · Nov 10, 2026