Key Raider: iOS Malware Steals Over 225,000 Apple Accounts to Create Free App Utopia
Summary: Researchers at Palo Alto Networks and WeipTech identified 92 samples of a new iOS malware family, KeyRaider, which stole over 225,000 valid Apple accounts along with thousands of push notification certificates, private keys and purchasing receipts. Distributed through third-party Cydia repositories in China to jailbroken devices, the malware hooked SSLRead and SSLWrite in the itunesstored process to intercept Apple ID credentials, and the stolen data was uploaded to a command and control server that itself contained a SQL injection vulnerability.
What's compelling: Two jailbreak tweaks tied to the stolen credentials were downloaded over 20,000 times, meaning roughly 20,000 users were abusing 225,000 stolen accounts, and over 67% of the stolen accounts traced back to a single distributor, bamu, who repackaged apps like iFile and iCleanPro with the malware.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Zero-Days & Exploits
- Related
- New Sign Drop Exploit Can Abuse Windows Defender to Bypass Security Protections Cyber Risks · Nov 13, 2026New Sign Drop Zero-Day Exploit Turns Windows CLFS Security Feature Into SYSTEM Access Cyber Risks · Nov 12, 2026November Patch Tuesday: An Overflowing Cornucopia of CVEs Cyber Risks · Nov 10, 2026