YiSpecter: First iOS Malware That Attacks Non-jailbroken Apple iOS Devices by Abusing Private APIs
Summary: Palo Alto Networks' Unit 42 identified YiSpecter, which it describes as the first iOS malware seen in the wild that abuses private APIs to attack both jailbroken and non-jailbroken devices, spreading primarily to users in mainland China and Taiwan. The malware has four components signed with enterprise certificates that download and install each other from a C2 server, hide their icons from SpringBoard, and can install or replace apps, hijack other apps to display ads, and change Safari settings; it had been in the wild over 10 months, and only one of 57 VirusTotal vendors detected it at the time of writing.
Key Takeaway: YiSpecter spread through ISP traffic hijacking and a Windows worm rather than the App Store, and nearly every antivirus engine on VirusTotal missed it - a reminder that detection coverage and app-store review are not the same as protection for the iPhones your executives carry.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Zero-Days & Exploits
- Related
- New Sign Drop Exploit Can Abuse Windows Defender to Bypass Security Protections Cyber Risks · Nov 13, 2026New Sign Drop Zero-Day Exploit Turns Windows CLFS Security Feature Into SYSTEM Access Cyber Risks · Nov 12, 2026November Patch Tuesday: An Overflowing Cornucopia of CVEs Cyber Risks · Nov 10, 2026