Group-IB highlights growing Apple-device targeting, noting the App Store as a frequent malware distributor and the potential risk from third-party stores under the EU DMA. The report introduces GoldPickaxe, an iOS Trojan derived from GoldDigger that harvests facial recognition data to impersonate users and access bank accounts. #GoldPickaxe #GroupIB #Checkm8
Keypoints
- Group-IB reports a shift in cybercrime focus toward Apple devices, with iOS/macOS malware increasing and App Store distribution rising in prominence.
- Third-party app stores under the EU Digital Markets Act are expected to amplify the risk of malware spreading to iOS devices.
- GoldPickaxe is an iOS Trojan, derived from the Android GoldDigger, designed to harvest facial recognition data to impersonate users and access bank accounts.
- The article emphasizes the importance of analyzing iOS malware and suggests jailbreaking as a method to inspect apps and study vulnerabilities.
- Checkm8 is a bootloader vulnerability affecting older Apple devices that cannot be fully fixed by software updates, underscoring persistent risk on older models.
- Jailbreaking workflows are outlined (Preparation, Execution, Post-Jailbreak, App Extraction) with tools like Palera1n, Dopamine, Sileo, Frida, and bagbak used for analysis.
- The conclusion calls for thorough analysis of iOS threats to better mitigate risks and protect against sophisticated threats like GoldPickaxe.
MITRE Techniques
- [T1195] Supply Chain – App Store distribution and third-party stores enable malware spread. “App Store becoming a frequent target for distributing malware. The introduction of third-party app stores under the EU’s Digital Markets Act is expected to further exploit this trend.”
- [T1078] Valid Accounts – Using stolen data to impersonate users to access bank accounts. “use stolen data to impersonate users and access their bank accounts.”
- [T1547] Boot or Logon Autostart Execution – Bootloader access via vulnerabilities like Checkm8 enabling persistence/early execution. “The Checkm8 vulnerability, discovered in 2019, affects the bootloader of older Apple devices and cannot be fully fixed with software updates.”
Indicators of Compromise
- [URL] image resource – https://www.group-ib.com/wp-content/uploads/blog2-2-1-min.png, context: article image used to illustrate GoldPickaxe discovery.
- [URL] primary source – https://www.group-ib.com/blog/goldpickaxe-ios-trojan/, context: Full Story / original Group-IB blog referenced in the article.
Read more: https://www.group-ib.com/blog/goldpickaxe-ios-trojan/