Palo Alto Networks Inc has discovered a new family of malware that can infect Apple Inc's desktop and mobile operating systems, underscoring the increasing sophistication of attacks on iPhones and Mac computers.
The "WireLurker" malware can install third-party applications on regular, non-jailbroken iOS devices and hop from infected Macs onto iPhones through USB connector-cables, said Ryan Olson, intelligence director for the company's Unit 42 division.
Palo Alto Networks said on Wednesday it had seen indications that the attackers were Chinese. The malware originated from a Chinese third-party apps store and appeared to have mostly affected users within the country.
The malware spread through infected apps uploaded to the apps store, that were in turn downloaded onto Mac computers. According to the company, more than 400 such infected apps had been downloaded over 350,000 times so far.
It's unclear what the objective of the attacks was. There is no evidence that the attackers had made off with anything more sensitive than messaging IDs and contacts from users' address books, Olson added.
But "they could just as easily take your Apple ID or do something else that's bad news," he said in an interview.
Apple, which Olson said was notified a couple weeks ago, did not respond to requests for comment on Wednesday.
Once WireLurker gets on an iPhone, it can go on to infect existing apps on the device, somewhat akin to how a traditional virus infects computer software programs. Olson said it was the first time he had seen it in action. "It's the first time we've seen anyone doing it in the wild," he added.
Why you need to be concerned about WireLurker
According to a press release issued by Palo Alto Networks, WireLurker is:
· The first known malware family that can infect installed iOS applications, similar to how a traditional virus would
· The first in-the-wild malware family that can install third-party applications on non-jailbroken iOS devices through enterprise provisioning
· The second known malware family that attacks iOS devices through OS X via USB
· The first malware family to automate generation of malicious iOS applications through binary file replacement
"WireLurker is unlike anything we’ve ever seen in terms of Apple iOS and OS X malware," said Olson.
"The techniques in use suggest that bad actors are getting more sophisticated when it comes to exploiting some of the world’s best-known desktop and mobile platforms."