Palo Alto Networks recently identified a new Apple iOS malware called YiSpecter.
YiSpecter attacks both jailbroken and non-jailbroken iOS devices through unique and harmful malicious behaviours.
“Specifically, it’s the first malware we’ve seen in the wild that abuses private APIs in the iOS system to implement malicious functionalities,” said Palo Alto Networks.
The malware primarily affected iOS users in China and Taiwan. It spreads via unusual means, including the hijacking of traffic from nationwide ISPs, an SNS worm on Windows, and an offline app installation and community promotion.
YiSpecter consists of four components that are signed with enterprise certificates.
By abusing private APIs, these components download and install each other from a command and control (C2) server.
Three of the malicious components use tricks to hide their icons from iOS’s SpringBoard, which prevents the user from finding and deleting them.
The components also use the same name and logos of system apps to trick iOS power users.
On infected iOS devices, YiSpecter can do the following:
- Download, install, and launch arbitrary iOS apps
- Replace existing apps with those it downloads
- Hijack other apps’ execution to display advertisements
- Change Safari’s default search engine, bookmarks, and opened pages
- Upload device information to the C2 server
Even if you manually delete the malware, it will automatically re-appear, stated the report.