Security Market Segment LS
Monday, 31 August 2015 14:16

Massive Apple account theft from new malware hit on iOS Featured


What is believed to be the largest known Apple account theft caused by malware has been reported after the discovery of 225,000 stolen valid Apple accounts with passwords stored on a server.

A technical group, WeipTech, consisting of users from Weiphone - one of the largest fan websites in China - found the Apple accounts on a server as they were analysing suspicious iOS tweaks reported by users.

Now, in cooperation with WeipTech, Palo Alto has said it has identified 92 samples of a new   malware family in the wild, naming the culprit malware responsible for the Apple account theft, “KeyRaider”.

“We believe this to be the largest known Apple account theft caused by malware,” says Claud Xiao in his blog posted on the Palo Alto website.  

According to Palo Alto, the Key Raider malware may have impacted users in Australia and 17 other countries, including China, France, Russia, Japan, United Kingdom, United States, Canada, Germany, Israel, Italy, Spain, Singapore, and South Korea.

Xia says Key Raider targets jailbroken iOS devices, is distributed through third-party Cydia repositories in China, and has successfully stolen over 225,000 valid Apple accounts and thousands of certificates, private keys, and purchasing receipts – “uploading stolen data to its command and control (C2) server, which itself contains vulnerabilities that expose user information.”

“The purpose of this attack was to make it possible for users of two iOS jailbreak tweaks to download applications from the official App Store and make in-app purchases without actually paying. Jailbreak tweaks are software packages that allow users to perform actions that aren’t typically possible on iOS.

“These two tweaks will hijack app purchase requests, download stolen accounts or purchase receipts from the C2 server, then emulate the iTunes protocol to log in to Apple’s server and purchase apps or other items requested by users. The tweaks have been downloaded over 20,000 times, which suggests around 20,000 users are abusing the 225,000 stolen credentials.”

According to Xia, some victims have reported that their stolen Apple accounts show abnormal app purchasing history and others state that their phones have been held for ransom.

Explaining how it works, Xia says the malware hooks system processes through MobileSubstrate, and steals Apple account usernames, passwords and device GUID by intercepting iTunes traffic on the device.  KeyRaider steals Apple push notification service certificates and private keys, steals and shares App Store purchasing information, and disables local and remote unlocking functionalities on iPhones and iPads.

Palo Alto and WeipTech have now provided services which they say will detect the KeyRaider malware and identify stolen credentials.

Subscribe to ITWIRE UPDATE Newsletter here


The much awaited iTWire Shop is now open to our readers.

Visit the iTWire Shop, a leading destination for stylish accessories, gear & gadgets, lifestyle products and everyday portable office essentials, drones, zoom lenses for smartphones, software and online training.

PLUS Big Brands include: Apple, Lenovo, LG, Samsung, Sennheiser and many more.

Products available for any country.

We hope you enjoy and find value in the much anticipated iTWire Shop.



iTWire TV offers a unique value to the Tech Sector by providing a range of video interviews, news, views and reviews, and also provides the opportunity for vendors to promote your company and your marketing messages.

We work with you to develop the message and conduct the interview or product review in a safe and collaborative way. Unlike other Tech YouTube channels, we create a story around your message and post that on the homepage of ITWire, linking to your message.

In addition, your interview post message can be displayed in up to 7 different post displays on our the site to drive traffic and readers to your video content and downloads. This can be a significant Lead Generation opportunity for your business.

We also provide 3 videos in one recording/sitting if you require so that you have a series of videos to promote to your customers. Your sales team can add your emails to sales collateral and to the footer of their sales and marketing emails.

See the latest in Tech News, Views, Interviews, Reviews, Product Promos and Events. Plus funny videos from our readers and customers.


Peter Dinham

Peter Dinham - retired in 2020. He is a veteran journalist and corporate communications consultant. He has worked as a journalist in all forms of media – newspapers/magazines, radio, television, press agency and now, online – including with the Canberra Times, The Examiner (Tasmania), the ABC and AAP-Reuters. As a freelance journalist he also had articles published in Australian and overseas magazines. He worked in the corporate communications/public relations sector, in-house with an airline, and as a senior executive in Australia of the world’s largest communications consultancy, Burson-Marsteller. He also ran his own communications consultancy and was a co-founder in Australia of the global photographic agency, the Image Bank (now Getty Images).

Share News tips for the iTWire Journalists? Your tip will be anonymous




Guest Opinion

Guest Reviews

Guest Research

Guest Research & Case Studies

Channel News