New iOS Remote Control Tool Targets Crypto Wallets and Keychain Data

Security researchers have issued a warning regarding a sophisticated remote access tool (RAT) currently circulating on underground forums. According to 23pds, the Chief Information Security Officer (CISO) of blockchain security firm SlowMist, this malicious software is specifically designed to compromise Apple mobile devices to exfiltrate sensitive information. The tool reportedly targets encrypted wallet data, Keychain credentials, and private communications, posing a significant risk to cryptocurrency holders who utilize mobile platforms for asset management.

Mechanism of Attack and System Vulnerabilities

The threat actors behind this tool utilize diverse delivery methods, including phishing links distributed via SMS, email, and various instant messaging applications. Once a user interacts with the malicious link, the tool attempts to exploit the device to gain unauthorized access. The developer of the software claims it can bypass advanced security features, including Pointer Authentication (PAC) and sandbox environments, to obtain kernel read/write permissions.

• Initial Access: Delivery via social engineering and malicious URLs.
• Privilege Escalation: Bypassing system protections to gain administrative control.
• Persistence: The ability to remain active on the device even after a system reboot.
• Data Exfiltration: Exporting Keychain data, chat logs, and file credentials.

Extensive Monitoring and Remote Control Capabilities

Beyond the theft of digital assets and private keys, the tool offers a centralized control panel for multi-device management. It allows attackers to perform real-time monitoring of the victim's surroundings and activities through the camera, microphone, and GPS location tracking. Furthermore, the software supports a remote Shell, enabling the attacker to execute commands directly on the compromised iOS device.

While the seller claims the tool supports versions ranging from iOS 13 to a future-dated version 27.2, security experts have expressed skepticism regarding these versioning claims, suggesting they may be exaggerated to attract buyers in the cybercriminal underground.

The tool claims to possess six capabilities: initial access, privilege escalation, persistence after reboot, data export, real-time monitoring, and remote control, involving techniques such as bypassing Pointer Authentication (PAC) and sandbox escape.

The emergence of such tools highlights the evolving threats facing the DeFi and broader cryptocurrency ecosystem. As mobile wallets become increasingly common, users are advised to maintain rigorous security hygiene, such as avoiding suspicious links and ensuring their operating systems are updated to the latest verified versions. The SlowMist team continues to monitor these underground developments to provide the community with timely threat intelligence and prevent the loss of digital assets.