iOS 8 malware can snoop on messages, photos & location data

iOS spyware can access users' text messages, photos and contact lists

Spyware targeting iOS 7 and iOS 8 devices has been uncovered by security firm Trend Micro, who claim it could be used to steal users' text messages, photos and contact data.

The surveillance software is one of a number of tools used by members of Operation Pawn Storm, an ongoing cyber-espionage project targeting government, military and media organisations.

"The actors of Pawn Storm tend to first move a lot of pawns in the hopes they come close to their actual, high-profile targets," the company said in a blog post.

"When they finally successfully infect [one], they might decide to move their next pawn forward: advanced espionage malware."

The spyware highlighted by Trend Micro falls into the latter category, and tends to be installed on devices that have already been compromised in the form of two malicious applications - XAgent (detected as IOS_XAGENT.A) and the one using the name of a legitimate iOS game, MadCap (detected as IOS_ XAGENT.B).

Their aim is to spy on activities of iOS device users and in the process steal their personal data, take screenshots, record audio and pass this data on to a command-and-control (C&C) server somewhere.

While the spyware works on iOS 7 and iOS 8 devices, its modus operandi depends on the operating system being used.

"After being installed on iOS 7, the app's icon is hidden and it runs in the background immediately. When we try to terminate it by killing the process, it will restart almost immediately.

"Installing the malware into an iOS 8 device yields different results. The icon is not hidden and it also cannot restart automatically. This suggests that malware was designed prior to the release of iOS 8 last September."

Interestingly, iOS devices do not need to be jailbroken in order to fall victim to this malware, Trend Micro added, and infection could be caused by connecting them to another compromised piece of hardware.

"One possible scenario is infecting an iPhone after connecting it to a compromised or infected Windows laptop via a USB cable," the blog post concluded. 

Featured Resources

Key considerations for implementing secure telework at scale

Identifying the security risks and advanced requirements of a remote workforce

Download now

The State of Salesforce 2020

Your guide to getting the most from Salesforce

Download now

Fast, flexible and compliant e-signatures for global businesses

Be at the forefront of digital transformation with electronic signatures

Download now

Rethink your cybersecurity strategy for the new world

5 steps to secure the enterprise and be fit for a flexible future

Download now

Recommended

Malware attacks using machine identities doubled in 2019
cyber security

Malware attacks using machine identities doubled in 2019

4 Aug 2020
Andrew Daniels joins Druva as CIO and CISO
Cloud

Andrew Daniels joins Druva as CIO and CISO

22 Jul 2020
Over two dozen Android apps found stealing user data
Google Android

Over two dozen Android apps found stealing user data

7 Jul 2020
University of California gets fleeced by hackers for $1.14 million
ransomware

University of California gets fleeced by hackers for $1.14 million

30 Jun 2020

Most Popular

How to find RAM speed, size and type
Laptops

How to find RAM speed, size and type

3 Aug 2020
How to use Chromecast without Wi-Fi
Mobile

How to use Chromecast without Wi-Fi

4 Aug 2020
Police use of facial recognition ruled unlawful in the UK
privacy

Police use of facial recognition ruled unlawful in the UK

11 Aug 2020