Protecting Users from iOS App Provisioning Profile Abuse
Summary: Unit 42 described two malware families, WireLurker and the Masque Attack, that abuse iOS app provisioning profiles to install potentially malicious apps on devices whether or not they are jailbroken. Because iOS MDM exposes only a brief summary of installed apps and profiles and offers no API for per-app certificate information, the post recommends IT admins maintain allowlists and denylists of provisioning profiles and alarm on any profile outside company management.
What you should know: Apple's policy holds that provisioning profiles are for internal testing or enterprise deployment only, so a profile on a managed device that IT does not control is itself the signal - and the Masque Attack showed MDM could not tell the malware from the original app because both used the same bundle identifier.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026