Loading story…
A security researcher showed that the anti-reverse-engineering controls in an anonymized 64-bit iOS banking app dubbed VIBA could be bypassed despite extensive runtime self-protection. The app used obfuscation, encrypted strings, anti-jailbreak checks, anti-Frida logic, debugger detection, file-integrity validation, and large volumes of raw syscalls to resist analysis on modified devices. The researcher found several protections relied on weak patterns, including simple XOR string decryption, recognizable success and failure constants, and ptrace and exit syscalls that could be patched out, allowing checks for Frida files, port 27042, injected dylibs, jailbreak artifacts, and Info.plist integrity to be defeated through static patching and runtime hooking.
Separate malware analysis detailed a stealth-focused macOS backdoor known as Tiny FUD that masquerades as Apple-like processes, hides itself from Finder, and communicates with a command-and-control server at 69.197.175.10:9999. The trojan collects host identifiers including UUID, username, hostname, and kernel version, executes remote commands, and captures screenshots every five minutes for exfiltration. Researchers said the sample also used self-signing with permissive entitlements, DYLD-related injection support, and cleanup routines to erase traces and terminate itself and child processes, and they published indicators including SHA-256 d64e2688344c685c4156819156bdb15630d1168314b21c919eee5540b1beb54a, related domains, and a YARA rule to aid detection.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
A researcher published an analysis of the iOS banking app anonymized as VIBA, detailing its anti-reverse-engineering and runtime self-protection mechanisms and showing how jailbreak, Frida, dylib injection, debugger, and integrity checks could be bypassed.
A researcher published an analysis of the Tiny FUD macOS backdoor, describing its stealth features, C2 communications, screenshot capture behavior, and indicators of compromise including a SHA-256 hash and YARA rule.
A researcher documented reversing an unnamed iOS banking app's obfuscated syscall-based jailbreak detection, including identifying stat64 checks against /private/var/lib/apt and patching multiple similar checks. The post also introduced a Frida-based iOS syscall tracer to reveal syscall names and arguments during dynamic analysis.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
developer.apple.com
Open sourcejuliangrtz.me
Open sourcedenwp.com
Open sourcejuliangrtz.me
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researchers reported a sophisticated iPhone exploitation framework dubbed **Coruna** that appears to have originated as a professionally developed, likely government-grade capability and later proliferated to foreign espionage and criminal actors. Analyses cited by Google’s Threat Intelligence Group and mobile security firm iVerify describe **five exploit chains** spanning **20+ vulnerabilities** affecting **iOS 13 through 17.2.1**, enabling delivery via malicious web content for device fingerprinting, remote code execution, and bypass of key iOS mitigations; the tool’s apparent usage trail includes alleged deployment by **Russian intelligence against Ukrainian targets** and subsequent adoption by a cybercrime group for cryptocurrency theft. Separate mobile-threat reporting detailed multiple **Android** campaigns and families emphasizing stealth, persistence, and credential theft. CloudSEK described a **RedAlert** trojanized app impersonating Israel’s Home Front Command alerting application, using a **multi-stage APK/DEX loader chain** (including an `assets/` payload) and UI mimicry while coercing high-risk permissions (e.g., Contacts, SMS, Location) and establishing C2. PolySwarm summarized **PromptSpy**, an Android RAT with VNC-based remote control that integrates **Google Gemini** to generate context-aware UI gesture instructions from screen XML dumps to improve persistence across device variants, distributed via a phishing site impersonating a bank portal and assessed as financially motivated (notably targeting Argentina). Zimperium separately profiled **ZeroDayRAT** as a modular Android spyware platform spread via social engineering and sideloading, supporting surveillance and financial theft (e.g., screen capture, keylogging, credential harvesting), underscoring continued escalation in mobile malware sophistication.
Jun 29, 2026
Researchers reported a new Go-based macOS stealer and backdoor, **notnullOSX**, being used in highly targeted campaigns against users believed to hold more than **$10,000 in cryptocurrency**. The malware has been linked to the developer previously known as **0xFFF**, later **alh1mik**, and was first detected in Vietnam, Taiwan, and Spain. Operators are distributing it through social-engineering lures including fake protected Google Docs, **ClickFix** terminal-prompt tricks, malicious DMG files, and counterfeit WallSpace wallpaper sites promoted through a likely hijacked YouTube channel. Once victims are persuaded to grant **Full Disk Access**, notnullOSX can steal browser credentials, Safari cookies, iMessage data, Apple Notes, Telegram sessions, crypto wallet files, and developer secrets. Researchers said the malware uses a modular architecture, downloads components from `cdn.filestackcontent.com`, and maintains persistent command-and-control through **Firebase Realtime Database** using SSE, HTTP POST, heartbeat traffic, and WebSocket-style connectivity. One module, **ReplaceApp**, appears designed to swap legitimate wallet tools such as **Ledger Live** or **Trezor** with trojanized versions to capture seed phrases, giving the operation capabilities closer to a remote access trojan than a conventional smash-and-grab stealer.
Jun 29, 2026
Researchers documented several malware campaigns that used fake software and trojanized packages to deliver credential theft and remote-access payloads. On Windows, a fake *Resident Evil 9* mod from GitHub triggered a `curl | cmd` chain that deployed hidden batch, JavaScript, portable Node.js, portable Python, and an in-memory Go payload with browser theft, wallet targeting, hVNC-style control, webcam-related code, and exfiltration via Wormhole/B2 and Gofile; a separate fake AI video player installer led through Python bytecode, shellcode, and protected .NET loaders to **PureRAT**, which persisted through the `Run` key and communicated over authenticated WebSockets with `agent.sm-veo.com`. Another Windows campaign, dubbed **Operation TURB00**, used a Go loader and decoy console program to launch **Vidar** in memory, steal browser and application data, and install persistence through `agt.dll` and the `CadenceOptimizer` service running under `svchost` as `LocalSystem`. On macOS, analysts reversed a fully undetected **Atomic macOS Stealer (AMOS)** sample distributed as a signed DMG, bypassed its anti-VM checks, and recovered an AppleScript payload that stole browser data, wallet files, Telegram Desktop data, documents, and system information before exfiltrating to `95.164.53.3/contact`. In the software supply chain, a malicious PyPI package, `nhmpy 2.4.7`, masqueraded as NumPy while using a `.pth` file and an obfuscated JavaScript payload executed through Bun to harvest developer, cloud, CI/CD, registry, SSH, wallet, messaging, VPN, and AI-assistant secrets; it then spread using stolen GitHub tokens and malicious GitHub Actions workflows. Separately, a public Windows local privilege escalation exploit named **REDSUN** showed how attackers could turn standard-user access into `NT AUTHORITY\SYSTEM` by abusing a TOCTOU flaw involving NTFS and the Cloud Files API, creating a potential post-compromise path for malware already running on a host.
Jul 12, 2026