23pds: Remote control tools targeting iOS systems have appeared on underground forums.

SlowMist CISO 23pds reports that an online forum is selling a remote control tool that claims to support iOS 13 to 27.2. This tool features a centralized control panel. Attackers can send phishing links via SMS, chat software, or email. Once clicked, the link grants the user access to their device, allowing them to steal keychain data, chat logs, file credentials, and encrypted wallet data. The tool can also monitor the camera, microphone, location, and screen, and supports remote shell access and multi-device management. This tool has six capabilities: initial access, privilege escalation, post-reboot persistence, data export, real-time monitoring, and remote control. It involves technologies such as bypassing pointer authentication (PAC), escaping the sandbox, and obtaining kernel read and write permissions.