iPhone "Infostealer" Malware: Analysis and Mitigation for Security Teams

A new wave of malware targeting iPhone users has emerged, leveraging fake software updates and phishing campaigns to compromise bank accounts and personal data. According to recent reports, over 26 million Apple users have been targeted since 2023, with 9 million new victims identified in early 2025¹. This article breaks down the technical mechanisms, impact, and defensive measures for security professionals.

TL;DR: Key Findings

Threat Vector: Fake update pop-ups and phishing links delivering JavaScript-based malware.
Impact: Credential theft, financial fraud, and data exfiltration.
Mitigation: Lockdown Mode, URL verification, and strict update policies.

Technical Analysis of the Infostealer Malware

The malware, dubbed “Infostealer,” mimics Apple’s update portal using domains like apple-security-update[.]top. It injects JavaScript to harvest credentials and session cookies². ESET Cybersecurity Advisor Jake Moore notes that the attack exploits trust in Apple’s branding, urging users to verify URLs before interacting with prompts³.

Kaspersky’s analysis reveals the malware uses obfuscated code to evade detection, with variants dynamically loading payloads from C2 servers. The infection chain includes:

Phishing emails/SMS with fraudulent update links.
Redirection to spoofed Apple domains.
Silent download of malware masquerading as a “security patch.”

Relevance to Security Teams

For red teams, this campaign highlights the effectiveness of social engineering combined with brand impersonation. Blue teams should prioritize:

Monitoring for anomalous DNS queries to suspicious domains (e.g., *.top, *.cyou).
Implementing network-level blocks for known malicious IPs tied to C2 servers.
Educating users on verifying update sources (Settings > General > Software Update).

Remediation Steps

Apple has released iOS 18.3.1 to patch CVE-2025-24200, a vulnerability bypassing USB Restricted Mode⁴. Recommended actions:

Action	Command/Path
Enable Lockdown Mode	`Settings > Privacy & Security > Lockdown Mode`
Report Phishing	Forward scams to 7726 (SPAM) or [email protected]

Conclusion

This campaign underscores the need for layered defenses against social engineering. Security teams should combine technical controls (e.g., DNS filtering) with user training to mitigate risks. Future variants may exploit AI voice cloning, as seen in recent FBI alerts⁵.