Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Update: Xcode Ghost Attacker Can Phish Passwords and Open URLs through Infected Apps

Summary: Unit 42's follow-up analysis found that XcodeGhost, which infected 39 iOS apps and potentially hundreds of millions of users, can receive commands from its C2 server to display fake alert dialogs that phish user credentials and to open URLs of any scheme the local iOS system handles. The malware also reads and writes data through the iOS clipboard on every launch of an infected app, and a V2EX user reported an infected app repeatedly prompting for an iCloud password while contacting the same C2 domain.

Key Takeaway: The malware bypassed Apple's code review and reached 39 apps, and Unit 42 notes that a few lines of code would let it steal passwords copied from managers like 1Password - meaning the trust users place in a prompt from a legitimate app is the attack surface.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related