After the XcodeGhost malware shook the Apple ecosystem, Palo Alto Networks has identified a new Apple iOS malware and christened it ‘YiSpecter’. So far, it has been found affecting iOS users in China and Taiwan.
The security firm said that the malware attacks both jailbroken and non-jailbroken iOS devices and is the first one that abuses private APIs in the iOS system to “implement malicious functionalities.”
“On infected iOS devices, YiSpecter can download, install and launch arbitrary iOS apps, replace existing apps with those it downloads, hijack other apps’ execution to display advertisements, change Safari’s default search engine, bookmarks and opened pages, and upload device information to the C2 [command and control] server”, Palo Alto Networks explained.
It lists some characteristics about the malware:
- Whether an iPhone is jailbroken or not, the malware can be successfully downloaded and installed
- Even if you manually delete the malware, it will automatically re-appear
- Using third-party tools you can find some strange additional “system apps” on infected phones
- On infected phones, in some cases when the user opens a normal app, a full screen advertisement will show
The researchers found that YiSpecter was spread by Lingdun worm and that main YiSpecter apps were also published on multiple underground app distribution websites. Moreover, it was also detected that the malware’s author tried to directly promote their malicious apps on social networks and in public communities.
Apple says it is aware of the vulnerability and fixed it in iOS 8.4. “This issue only impacts users on older versions of iOS who have also downloaded malware from untrusted sources. We addressed this specific issue in iOS 8.4 and we have also blocked the identified apps that distribute this malware,” Apple told TechWeekEurope. “We encourage customers to stay current with the latest version of iOS for the latest security updates. We also encourage them to only download from trusted sources like the App Store and pay attention to any warnings as they download apps.”
Palo Alto Networks has released IPS and DNS signatures to block YiSpecter’s malicious traffic.


LG Energy Solution Q2 Profit Plunges 77% Despite Revenue Growth on Weak EV Demand
Samsung Chairman Lee Jae-yong Expected to Meet Nvidia CEO Jensen Huang on AI and Chip Partnership
Samsung to Launch First Yongin Chip Plant by 2029 as South Korea Speeds Up Semiconductor Hub
Zhipu AI Raises HK$31.37 Billion in Discounted Share Sale to Accelerate AI Growth
Yaskawa Electric Shares Slide as Weak Profit Overshadows Strong AI Demand
Chinese Chip Stocks Jump as Apple Reportedly Tests CXMT Memory Chips for China Devices
Nvidia Invests $500M in Firmus Technologies Ahead of Planned ASX IPO
SK Hynix’s $28 Billion U.S. Share Sale Draws Massive Demand Amid AI Chip Boom
EU to Propose New Rules Limiting Children's Access to Social Media
Morgan Stanley Says China’s Reusable Rocket Progress Poses Long-Term Challenge to SpaceX
Bain Capital Exits Kioxia After AI-Fueled Valuation Surge
Apple Tests China's CXMT Memory Chips as DRAM Maker Gains Global Market Share
China 618 Smartphone Sales Drop 13% as Higher Prices Hurt Demand, Huawei Gains Market Share
TSMC Q2 Revenue Surges 36% as AI Chip Demand Powers Growth Ahead of Earnings
OpenAI GPT-5.6 Set for Wider Release After U.S. Commerce Approval, Report Says 



