Loading story…
A Trojanized version of Apple’s Xcode development environment, dubbed XcodeGhost, was used to infect iOS applications built by developers who downloaded repackaged installers from unofficial sources. The malicious Xcode packages, affecting versions 6.1 through 6.4, contained a Mach-O object file named CoreServices that was automatically linked into compiled apps through Xcode’s default framework search paths, turning trusted developer tools into a software supply-chain attack vector.
Apps built with the tainted toolchain collected device and application metadata, encrypted the data, and transmitted it over HTTP to command-and-control domains including init.crash-analytics.com, init.icloud-diagnostics.com, and init.icloud-analysis.com. At least two infected iOS apps, including NetEase Cloud Music, reportedly passed Apple’s App Store review and were published, underscoring the risk not only to App Store users but also to enterprise and other non-App-Store software distribution channels.
Trace attribution and downstream blast radius.
6 events from the most recent confirmed update back to the earliest known activity.
Palo Alto Networks Unit 42 published a report detailing XcodeGhost as a Trojanized Xcode supply-chain attack that infected iOS apps and reached Apple's App Store. The report identified the malware's CoreServices object file, data theft behavior, and command-and-control domains.
Palo Alto Networks alerted Baidu that malicious Xcode installers were being hosted on its file-sharing service. Baidu subsequently removed the malicious files from Baidu Yunpan.
At least two iOS applications compiled with the Trojanized Xcode passed Apple's App Store review and were published with XcodeGhost code embedded. The reference specifically confirms NetEase Cloud Music version 2.8.3 as one infected app.
Attackers distributed repackaged Xcode installers, including versions 6.1 through 6.4, through Baidu Yunpan and links shared on Chinese developer forums and websites. Developers who used these unofficial installers unknowingly compiled malicious code into their apps.
After the initial Sina Weibo disclosures, Alibaba researchers published an analysis of the malware and gave it the name XcodeGhost. The reference does not provide a specific date for this publication.
Chinese developers disclosed the malware on Sina Weibo before Alibaba researchers later published an analysis and named it XcodeGhost. This marks the earliest explicitly described public disclosure event in the reference.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 12 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See attribution and downstream blast radius, and whether this package or vendor reaches your builds.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Hungary's National Cybersecurity Institute warned that **DarkSword**, a publicly available spyware and exploit kit for Apple devices, is targeting iPhones and iPads running `iOS 18.4` through `18.7` and corresponding `iPadOS` versions. The malware was described as easy to deploy after its code was released on a popular code-sharing platform, lowering the barrier for cyber-espionage activity. Once executed, DarkSword can steal contacts, messages, call history, authentication-related data, and other sensitive information, then exfiltrate it to attacker-controlled servers before deleting itself from the device to hinder detection. New reporting says the operation has since grown into a broad malicious web infrastructure spanning **180 web properties and 27 hosts**, using fake Apple sign-in pages, Apple-themed lures, and compromised websites to deliver a leaked six-vulnerability exploit chain and **GHOSTBLADE** data-theft modules. Researchers said successful compromise can expose keychain contents, iCloud data, Wi-Fi credentials, files, and Apple ID credentials, while operators rotate servers quickly and remove artifacts such as crash reports and `RemoteLog.log` to frustrate forensic analysis. Defenders were urged to apply Apple security updates, enable **Lockdown Mode** where patching is delayed, and monitor for recurring infrastructure fingerprints tied to the campaign.
Aug 4, 2026
Thirteen trojanized Composer theme packages for the OphimCMS and KKPhim streaming-site ecosystems injected malicious JavaScript into every visitor page, sending users to gambling and ad-fraud content and selectively attacking externally referred, non-desktop visitors. On vulnerable iPhones, the packages delivered a FUNNULL-hosted WebKit-to-kernel exploit chain targeting `CVE-2025-31277`, `CVE-2025-43529`, and an AppleM2ScalerCSCDriver kernel primitive; the campaign targeted iOS 18.4 through 18.6.x rather than updated versions. The spyware harvested keychain data, messages, photos, browser cookies, location history, and cryptocurrency wallet seed phrases, then exfiltrated them to rotating command-and-control infrastructure. Operators redeployed the exploit chain and added wallet theft capabilities, while FUNNULL-linked infrastructure has continued operating after sanctions, with activity reportedly being separated from the FUNNULL CDN brand.
Sep 2, 2026
A chain of flaws in Apple’s iTunes Store and `StoreKitUIService` components allowed attacker-controlled content to execute inside a privileged iOS WebView and escalate to arbitrary code execution. A crafted `itms://` or `itms-ui` URL could bypass hostname trust checks and load malicious secondary content, including `data:` URIs, producing client-side XSS in a trusted Apple app context; that issue was tracked as **CVE-2021-1748**. In the same environment, an overly permissive Objective-C `WebScripting` bridge exposed native methods to JavaScript, enabling disclosure of device and account data, local file access within the app container, app enumeration and launching, heap pointer leaks, and direct object deallocation from script.
Aug 1, 2026