However, as Kent-Payne points out in his report on the matter, a malicious custom keyboard could theoretically be distributed via any app. To reach potential victims, the hackers behind this campaign are abusing Apple’s own TestFlight platform which is used for testing new iOS apps before they’re released on the App Store.īy putting out their malicious keyboards via TestFlight, the hackers are able to avoid being detected by Apple since apps on the platform don’t undergo the same rigorous security tests that App Store apps do. While Certo didn’t go into all of the nitty gritty details about this attack to avoid providing other hackers with a blueprint, it did explain how it works.
From here, a hacker can discreetly capture and transmit all of the keystrokes an iPhone user makes on their device. What sets this new attack apart though, is that it doesn’t rely on either of these methods to spy on iPhone users.Īlthough they’re not normally dangerous, this attack weaponized third-party keyboards by using malicious ones to serve as keyloggers on vulnerable devices. Normally when it comes to spying on iPhone users, an attacker would need to jailbreak a target’s device or gain access to their iCloud account. (Image credit: Certo Software/Tom's Guide) The default iOS keyboard can be seen on the left while a custom keyboard that works as a keylogger is pictured on the right.
