Kaspersky said previously that the attack worked by sending an iMessage with a malicious attachment. Without ever seeing that message, the phone’s user would be infected and the attacker could run code of their choosing. The infection would disappear when users turned their phones off and on again, which experts say consumers should do at regular intervals. Apple’s optional Lockdown Mode also blocked the attacks.
On Wednesday, Kaspersky gave more detail, saying that the malicious code installed after infection had 24 commands, including extracting passwords from Apple’s Keychain, monitoring locations, and modifying or exporting files.
“As we delved into the attack, we discovered a sophisticated iOS implant that displayed numerous intriguing oddities,” said Kaspersky’s Georgy Kucherin, one of three credited by Apple with discovering the vulnerabilities. Kaspersky dubbed the attack Triangulation, and it and others have released tools to check if devices are infected.
Apple said the fixes would protect iPhones running iOS 15.7 or earlier, which became out of date in September. More recent versions of the operating system had other improvements that made them impervious to the attacks. Apple said 90 percent of customers who bought devices in the past four years have updated to iOS 16, the latest major release.
Kaspersky thanked Apple for working with it to analyze…