WireLurker malware targets Apple mobile devices in China

A sophisticated malware attack against Apple devices has been discovered by researchers at Palo Alto Networks. The researchers said that the "WireLurker" malware is currently limited to users of a Chinese application store.

The campaign revolves around infecting Mac OS X applications with "WireLurker," which collects call logs, phone book contacts and other information on Apple mobile devices.

According to Palo Alto's research paper, around 467 Mac OS X applications offered on a Chinese third-party application store called Maiyadi were found to have been seeded with WireLurker, including "The Sims 3," "International Snooker 2012" and "Pro Evolution Soccer 2014."

The paper added that those applications and others have been downloaded 356,104 times in the last six months and "may have impacted hundreds of thousands of users."

Apple has advised its users to download applications only from its App Store and not from third-party stores for security reasons.

Ryan Olson, intelligence director for Palo Alto Network's Unit 42, the intelligence branch of the company, said that some people are using Maiyadi store because it offers applications for free.

At least three versions of WireLurker were analyzed by Palo Alto, each of which were improvements on the previous one, Olson said. "We think we sort of caught someone developing the attack, and they haven't gotten to the point of launching the full attack," Olson said. "From our perspective, it still looks like an information gathering operation."

The malware is significant for how it leverages desktop Mac applications as part of the attack on iOS. If someone downloaded a Mac OS X desktop application from Maiyadi, WireLurker came along with it.