Spyware-Laden Modified iOS Apps Distributed via Russian Telegram Channel, Kaspersky Discovers
Kaspersky researchers have uncovered a scheme distributing modified iOS applications containing spyware through a Russian-language Telegram channel.
The collection includes altered versions of an online marketplace for selling goods, a photo editor, and a video viewing service. These apps are presented as ad-free and feature-rich, making them attractive to users seeking free enhancements.
Attackers insert a malicious module into otherwise legitimate applications. Some unmodified apps in the channel simply advertise the same Telegram source, directing users toward the infected files.
Installation requires sideloading: users must download an IPA file, purchase a developer certificate, and sign the application using tools such as eSign or Scarlet. The process can also be performed from a computer or on a jailbroken device, avoiding the App Store entirely.
While the app remains open, the spyware gathers the device name, battery level, regional settings, memory details, and jailbreak status. It can also obtain geolocation data, the mobile operator code, and capture screenshots before transmitting everything to the attackers.
The malware does not function in the background, so surveillance stops when the application is closed. Nevertheless, a single captured screenshot can still provide significant value to the operators.
Kaspersky recommends installing applications exclusively from trusted sources such as the official App Store or verified developer websites to avoid such risks.
Related articles
DDoS-Guard Reports Record 540,000 L7 Attacks in June 2026 Amid Botnet Fragmentation
DDoS-Guard recorded a sharp 70% increase in L7 attacks during Q2 2026, with June alone seeing 540,000 incidents. Global volumetric attacks doubled compared to all of 2025, including peaks of 1.64 Tbps and 1.58 Tbps. Law enforcement dismantled four major IoT botnets—Aisuru, KimWolf, JackSkid and Mossad—in March, yet long-duration L7 campaigns surged 380%. Attackers shifted focus to application-layer exhaustion using browser automation and AI agents while targeting HR platforms and news sites. Europol’s Operation PowerOFF led to 75,000 warnings and 53 domain takedowns across 21 countries. Experts attribute the June spike to attacks aimed at protection providers themselves rather than single domains.
DarkSword Exploit Kit Expands to 180 Sites Targeting iPhone Users with Zero-Click Chain
The DarkSword exploit kit has scaled its infrastructure to 180 web properties hosted on 27 servers, enabling zero-click compromise of iPhones running vulnerable iOS versions. Attackers deploy fake pages impersonating Apple, AWS, and other popular services to trigger a six-vulnerability exploit chain that achieves remote code execution, sandbox escape, and privilege escalation on iOS 18.4 through 18.7. Once the device is compromised, GHOSTBLADE components extract data from the Keychain, iCloud files, Wi-Fi passwords, and other stored content before exfiltrating it to attacker-controlled panels. The malware deletes crash reports and forensic logs to hinder analysis and does not establish traditional persistence, limiting the window of data theft to a single visit. Infrastructure rotates rapidly, with five of seven administrative panels observed on July 30, 2026, having appeared only a week earlier, indicating frequent domain and host replacement to evade blocking.
Octagon Android RAT Poses as Bahrain Emergency Alert App to Steal Credentials and Establish Persistent Surveillance
A remote access trojan named Octagon targets Android devices by masquerading as the official emergency alerts application from Bahrain. The infection begins when victims download the BH-Alert.apk file from phishing websites. The malware guides users through seven steps to grant dangerous permissions while using encrypted code hidden inside a font file extension to evade static analysis. It installs a secondary component called OctagonPanel and deploys mutual-monitoring surveillance services that restart each other if terminated. Additional persistence is achieved through boot receivers, a fake Android account, and scheduled synchronization tasks every 30 minutes. The trojan abuses the Accessibility Service to record unlock patterns, PINs, and passwords while also harvesting SMS messages, contacts, call logs, and screenshots. A criminal-controlled VPN allows interception and redirection of victim traffic.
Distributed Crawler Poses as Human Visitor to Evade Analytics and Ad Filters
A detailed investigation revealed a sophisticated distributed crawler that successfully mimicked legitimate human browsing behavior across multiple unrelated websites. The crawler generated realistic events in Google Analytics while avoiding ad script loading and resource chains that would confirm genuine user sessions. Server logs showed consistent patterns of fake search engine referrers, internal navigation with fabricated Referer headers, and selective requests limited mostly to images returning 404 errors. Analysts built a graph-based detection system that correlated events across sites to expose the coordinated activity despite individual requests appearing benign. The campaign rotated browser signatures and IP addresses frequently, making single-site rate limiting ineffective. The case demonstrates how modern crawlers can exploit Measurement Protocol and incomplete bot detection to consume server resources without contributing to revenue.