Chinese, Taiwanese users feel the pinch of new iOS malware YiSpecter

After the XcodeGhost malware shook the Apple ecosystem, Palo Alto Networks has identified a new Apple iOS malware and christened it ‘YiSpecter’. So far, it has been found affecting iOS users in China and Taiwan.

The security firm said that the malware attacks both jailbroken and non-jailbroken iOS devices and is the first one that abuses private APIs in the iOS system to “implement malicious functionalities.”

“On infected iOS devices, YiSpecter can download, install and launch arbitrary iOS apps, replace existing apps with those it downloads, hijack other apps’ execution to display advertisements, change Safari’s default search engine, bookmarks and opened pages, and upload device information to the C2 [command and control] server”, Palo Alto Networks explained.

It lists some characteristics about the malware:

• Whether an iPhone is jailbroken or not, the malware can be successfully downloaded and installed
• Even if you manually delete the malware, it will automatically re-appear
• Using third-party tools you can find some strange additional “system apps” on infected phones
• On infected phones, in some cases when the user opens a normal app, a full screen advertisement will show

The researchers found that YiSpecter was spread by Lingdun worm and that main YiSpecter apps were also published on multiple underground app distribution websites. Moreover, it was also detected that the malware’s author tried to directly promote their malicious apps on social networks and in public communities.

Apple says it is aware of the vulnerability and fixed it in iOS 8.4. “This issue only impacts users on older versions of iOS who have also downloaded malware from untrusted sources. We addressed this specific issue in iOS 8.4 and we have also blocked the identified apps that distribute this malware,” Apple told TechWeekEurope. “We encourage customers to stay current with the latest version of iOS for the latest security updates. We also encourage them to only download from trusted sources like the App Store and pay attention to any warnings as they download apps.”

Palo Alto Networks has released IPS and DNS signatures to block YiSpecter’s malicious traffic.