App Buyer: New iOS Malware Steals Apple ID and Password to Buy Apps
Summary: Palo Alto Networks analyzed AppBuyer, a new iOS trojan found on jailbroken devices that connects to a command-and-control server, hooks network APIs to steal the victim's Apple ID, GUID and password, and uploads them to 106.187.38.163. The malware's updatesrv daemon runs every 7,200 seconds and over three execution cycles installs a Cydia Substrate tweak and a fake gzip binary that emulates App Store login and purchase protocols to buy apps using the stolen credentials.
What you should know: The sample's command-and-control servers were still alive at publication, and the researchers still did not know how AppBuyer reached the device, so deleting the dropped files may not fully remove it. A prior jailbreak-targeting malware cited in the same report, AdThief, infected more than 75,000 devices.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Zero-Days & Exploits
- Related
- New Sign Drop Exploit Can Abuse Windows Defender to Bypass Security Protections Cyber Risks · Nov 13, 2026New Sign Drop Zero-Day Exploit Turns Windows CLFS Security Feature Into SYSTEM Access Cyber Risks · Nov 12, 2026November Patch Tuesday: An Overflowing Cornucopia of CVEs Cyber Risks · Nov 10, 2026