Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

More Details on the Xcode Ghost Malware and Affected iOS Apps

Summary: Unit 42 reported that XcodeGhost, a modified Xcode compiler, infected more than 39 iOS apps in the App Store, including versions of WeChat and Didi, potentially affecting hundreds of millions of users. The malware added malicious CoreServices object files and altered the Ld.xcspec file so the linker forcibly linked them into app executables, while its C2 servers, launched in March 2015, used HTTP with DES encryption in ECB mode.

Bottom line: Even after Amazon shut down the C2 servers and Apple began removing infected apps on September 18, Palo Alto Networks found infected apps such as China Unicom Mobile Office 3.2 still in the App Store on September 21, and a vulnerability letting any man in the middle control infected apps remains on affected devices.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Detection & Response
Related
YARA-X 1.23.0 Release, (Sun, Nov 15th) Cyber Risks · Nov 15, 2026