Loading story…
Bishop Fox reported that shared C# assemblies in .NET MAUI applications can be recovered and decompiled from both Android and iOS packages, exposing business logic implemented once and deployed across platforms. Android assemblies may be stored as LZ4-compressed payloads in libassembly-store.so or libassemblies.<abi>.blob.so; the mauidll utility can extract them into PE/.NET DLLs readable by tools such as ILSpy. iOS MAUI applications commonly retain managed DLLs directly within the IPA application's bundle, while libaot-*.dll.so files are native Mono AOT code rather than directly decompilable .NET assemblies.
The exposed shared layer can reveal hardcoded credentials, insecure SecureStorage implementations, authorization or cryptographic flaws, and vulnerable NuGet dependencies, allowing a single defect to affect Android and iOS releases simultaneously. Organizations should treat client-side code as public, align mobile testing with the OWASP Mobile Top 10, move sensitive authorization and security controls to backend services, validate secure-storage configurations, audit third-party dependencies, and assess both mobile platforms as one unified attack surface; obfuscation and runtime-integrity controls provide only defense in depth.
See affected versions and whether adversaries are exploiting it.
1 event from the most recent confirmed update back to the earliest known activity.
Bishop Fox described how managed .NET MAUI assemblies can be recovered from Android assembly-store payloads or iOS application bundles and decompiled, exposing shared logic across Android and iOS. The analysis highlighted risks including hardcoded secrets, weak storage protections, authorization and cryptographic flaws, and vulnerable NuGet dependencies.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A Trojanized version of Apple’s Xcode development environment, dubbed **XcodeGhost**, was used to infect iOS applications built by developers who downloaded repackaged installers from unofficial sources. The malicious Xcode packages, affecting versions **6.1 through 6.4**, contained a Mach-O object file named `CoreServices` that was automatically linked into compiled apps through Xcode’s default framework search paths, turning trusted developer tools into a software supply-chain attack vector. Apps built with the tainted toolchain collected device and application metadata, encrypted the data, and transmitted it over HTTP to command-and-control domains including `init.crash-analytics.com`, `init.icloud-diagnostics.com`, and `init.icloud-analysis.com`. At least two infected iOS apps, including **NetEase Cloud Music**, reportedly passed Apple’s App Store review and were published, underscoring the risk not only to App Store users but also to enterprise and other non-App-Store software distribution channels.
Aug 14, 2026
Researchers at Wake Forest University found widespread credential leakage in AI-enabled iOS apps, reporting that **282 of 444** tested applications exposed exploitable access to LLM services or supporting backends during normal use. The affected apps spanned 13 categories, including productivity, education, utilities, entertainment, lifestyle, and health and fitness, and included both niche titles and highly popular apps with millions of ratings. The exposed data created opportunities for attackers to abuse developers’ LLM accounts, consume cloud resources, and access backend services. The study identified three recurring failure patterns: plaintext API keys sent directly to LLM providers, unauthenticated backend proxy endpoints, and replayable JWT bearer tokens with weak or broken expiration controls. Researchers said many apps lacked effective protections against traffic interception, and common defenses could be bypassed through VPN-based transparent capture. After responsible disclosure and a 90-day retest, remediation remained limited: about **28%** of vulnerable apps had fixed the issues, while dozens remained exploitable because developers made little change or relied on fundamentally flawed authentication designs.
Jul 12, 2026
A security researcher showed that the anti-reverse-engineering controls in an anonymized 64-bit iOS banking app dubbed **VIBA** could be bypassed despite extensive runtime self-protection. The app used obfuscation, encrypted strings, anti-jailbreak checks, anti-`Frida` logic, debugger detection, file-integrity validation, and large volumes of raw syscalls to resist analysis on modified devices. The researcher found several protections relied on weak patterns, including simple XOR string decryption, recognizable success and failure constants, and `ptrace` and `exit` syscalls that could be patched out, allowing checks for Frida files, port `27042`, injected dylibs, jailbreak artifacts, and `Info.plist` integrity to be defeated through static patching and runtime hooking. Separate malware analysis detailed a stealth-focused macOS backdoor known as **Tiny FUD** that masquerades as Apple-like processes, hides itself from Finder, and communicates with a command-and-control server at `69.197.175.10:9999`. The trojan collects host identifiers including UUID, username, hostname, and kernel version, executes remote commands, and captures screenshots every five minutes for exfiltration. Researchers said the sample also used self-signing with permissive entitlements, `DYLD`-related injection support, and cleanup routines to erase traces and terminate itself and child processes, and they published indicators including SHA-256 `d64e2688344c685c4156819156bdb15630d1168314b21c919eee5540b1beb54a`, related domains, and a YARA rule to aid detection.
Jul 12, 2026