Security Market Segment LS
Monday, 31 August 2015 14:16

Massive Apple account theft from new malware hit on iOS Featured


What is believed to be the largest known Apple account theft caused by malware has been reported after the discovery of 225,000 stolen valid Apple accounts with passwords stored on a server.

A technical group, WeipTech, consisting of users from Weiphone - one of the largest fan websites in China - found the Apple accounts on a server as they were analysing suspicious iOS tweaks reported by users.

Now, in cooperation with WeipTech, Palo Alto has said it has identified 92 samples of a new   malware family in the wild, naming the culprit malware responsible for the Apple account theft, “KeyRaider”.

“We believe this to be the largest known Apple account theft caused by malware,” says Claud Xiao in his blog posted on the Palo Alto website.  

According to Palo Alto, the Key Raider malware may have impacted users in Australia and 17 other countries, including China, France, Russia, Japan, United Kingdom, United States, Canada, Germany, Israel, Italy, Spain, Singapore, and South Korea.

Xia says Key Raider targets jailbroken iOS devices, is distributed through third-party Cydia repositories in China, and has successfully stolen over 225,000 valid Apple accounts and thousands of certificates, private keys, and purchasing receipts – “uploading stolen data to its command and control (C2) server, which itself contains vulnerabilities that expose user information.”

“The purpose of this attack was to make it possible for users of two iOS jailbreak tweaks to download applications from the official App Store and make in-app purchases without actually paying. Jailbreak tweaks are software packages that allow users to perform actions that aren’t typically possible on iOS.

“These two tweaks will hijack app purchase requests, download stolen accounts or purchase receipts from the C2 server, then emulate the iTunes protocol to log in to Apple’s server and purchase apps or other items requested by users. The tweaks have been downloaded over 20,000 times, which suggests around 20,000 users are abusing the 225,000 stolen credentials.”

According to Xia, some victims have reported that their stolen Apple accounts show abnormal app purchasing history and others state that their phones have been held for ransom.

Explaining how it works, Xia says the malware hooks system processes through MobileSubstrate, and steals Apple account usernames, passwords and device GUID by intercepting iTunes traffic on the device.  KeyRaider steals Apple push notification service certificates and private keys, steals and shares App Store purchasing information, and disables local and remote unlocking functionalities on iPhones and iPads.

Palo Alto and WeipTech have now provided services which they say will detect the KeyRaider malware and identify stolen credentials.

Read 9980 times

Please join our community here and become a VIP.

Subscribe to ITWIRE UPDATE Newsletter here
JOIN our iTWireTV our YouTube Community here


Thoughtworks presents XConf Australia, back in-person in three cities, bringing together people who care deeply about software and its impact on the world.

In its fifth year, XConf is our annual technology event created by technologists for technologists.

Participate in a robust agenda of talks as local thought leaders and Thoughtworks technologists share first-hand experiences and exchange new ways to empower teams, deliver quality software and drive innovation for responsible tech.

Explore how at Thoughtworks, we are making tech better, together.

Tickets are now available and all proceeds will be donated to Indigitek, a not-for-profit organisation that aims to create technology employment pathways for First Nations Peoples.

Click the button below to register and get your ticket for the Melbourne, Sydney or Brisbane event



It's all about Webinars.

Marketing budgets are now focused on Webinars combined with Lead Generation.

If you wish to promote a Webinar we recommend at least a 3 to 4 week campaign prior to your event.

The iTWire campaign will include extensive adverts on our News Site and prominent Newsletter promotion and Promotional News & Editorial. Plus a video interview of the key speaker on iTWire TV which will be used in Promotional Posts on the iTWire Home Page.

Now we are coming out of Lockdown iTWire will be focussed to assisting with your webinars and campaigns and assistance via part payments and extended terms, a Webinar Business Booster Pack and other supportive programs. We can also create your adverts and written content plus coordinate your video interview.

We look forward to discussing your campaign goals with you. Please click the button below.


Peter Dinham

Peter Dinham - retired in 2020. He is a veteran journalist and corporate communications consultant. He has worked as a journalist in all forms of media – newspapers/magazines, radio, television, press agency and now, online – including with the Canberra Times, The Examiner (Tasmania), the ABC and AAP-Reuters. As a freelance journalist he also had articles published in Australian and overseas magazines. He worked in the corporate communications/public relations sector, in-house with an airline, and as a senior executive in Australia of the world’s largest communications consultancy, Burson-Marsteller. He also ran his own communications consultancy and was a co-founder in Australia of the global photographic agency, the Image Bank (now Getty Images).

Share News tips for the iTWire Journalists? Your tip will be anonymous




Guest Opinion

Guest Interviews

Guest Reviews

Guest Research

Guest Research & Case Studies

Channel News