MobileSec #0 — A PDF that crashes iOS, exploits in Instagram ads, patched banking apps
Mobile security moves very fast, but most security newsletters treat it as a side note. I wanted one place to follow mobile updates, exploits and vulnerabilities, with best practices and plain-language explanations of the terminology for anyone getting into the field. I’m a big fan of Vulnerable U and tl;dr sec, but I couldn’t find anything like them for mobile. So I decided to build it myself.
I also wanted to include liveness and biometrics news. This is my day job, so expect this section in every issue.
My promise: no AI slop. Every claim has a source, and I read or tested everything myself. My English writing isn’t perfect yet, so I use some tools to proofread it (like Hemingway).
Enjoy!
Exploits
iOS
Broken PDF
The headline bug in late September was CVE-2026-86950: an out-of-bounds write in CoreGraphics (the code writes past the end of a memory buffer, into memory it doesn’t own). It’s already fixed in iOS 26.7.1/18.7.11. Apple says it “may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27”.
Calif followed up with a writeup. They built a PDF with a specially crafted TrueType font that crashes CoreGraphics on both iOS and macOS. I’ve tested this PDF and managed to get a crash. However, figuring out how to get from here to something more interesting is no job for an average mind like mine :)
Spoiler: they got much further. See the “Before You Go” section at the end.
Malicious ads
An iPhone got hacked through an Instagram ad. No click needed.
First, the DarkSword story continues. DarkSword is a leaked one-click exploit chain for iOS 18.4–18.7, written entirely in JavaScript. The script gets into SpringBoard (the iOS home screen process), steals Keychain data, photos and Notes, and takes commands from a remote server.
Then iVerify and Report URI showed how it gets delivered: ads. The victim, an employee at a financial institution, was compromised by a World Cup-themed Instagram ad while just scrolling the feed. The same operator runs a second iOS exploit kit, Coruna, and spreads both through expired ad and analytics domains that thousands of websites still load.
At the same time, Citizen Lab and Confiant published the high-end version of the same trick. Discover-Tech, an Israeli “adtech” company, was certified by Google and IAB Europe for years and turned out to be a delivery pipeline for mercenary spyware. Same mechanics as Coruna: ads.
Possibly related (I can’t confirm it): Apple sent out a wave of threat notifications, saying that iPhone users “had been exposed to a targeted espionage attack using advanced software of the type developed by companies like NSO Group, known for its ‘Pegasus’ program”.
Photo below from a post by one of the people who got this message:
Well, that’s a few more reasons to block ads as hard as you can :) Also, don’t forget about Lockdown Mode (an extreme protection mode on iOS) and keep iOS up to date.
Android
Hirudo
ThreatFabric found a new Android trojan, Hirudo. It can draw a web overlay on top of other apps, delete the real banking app and replace it with a patched copy.
In short: the user installs an APK from an ad (e.g. a shopping app). But it’s just a lure. After a while, the app claims it needs an update to keep working, pushes a malicious APK on the user and asks for full Accessibility access (which lets an app read the screen and tap on your behalf). Once the user grants it, it’s game over.
Don’t be fooled by fake app updates, and never give any app full Accessibility access. That should be taught in schools!
Microsoft Authenticator, CVE-2026-80097
Enclave found a bug that let any app, with zero permissions, steal corporate account tokens from Microsoft Authenticator.
In short: Authenticator is not just TOTP codes. It’s an authentication broker: other Microsoft apps ask it for tokens over Android IPC (Intents), so you don’t have to type your login and password every time. It turned out it never checked that the caller was who it claimed to be. If an app sent an Intent saying “I am Teams, give me tokens”, Authenticator only checked that Teams was installed and handed the tokens over to the malicious app. How do you ship that?
Microsoft has patched the issue as CVE-2026-80097. If you use Microsoft Authenticator on Android, update it now to 6.2606.4246 or higher.
Liveness & Biometry
There’s a lot to cover here (more in the next issues), but I picked one topic: how do you prove the pixels came from a real camera?
Apple’s answer is hardware: they introduced Apple Reference Image, an opt-in mode on the new iPhone 18 Pro, where the sensor signs pixel data at capture and Private Cloud Compute turns the raw data into the final image. Succinct’s ZCAM is the app-level version: Secure Enclave, App Attest (Apple’s API that proves a request comes from a genuine app on a genuine device) and C2PA (an open standard for attaching signed provenance to photos and videos). Both protect the capture pipeline, but Apple’s approach covers the whole sensor-to-OS channel. This is exactly what injection attacks target (feeding fake video straight into the app, bypassing the camera). Apple offers no developer API, so for now it is just a camera feature. ZCAM has an SDK, but its reference implementation is unaudited and, as far as I can tell, not production-ready.
I also came across a different approach: cross-checking the camera against another sensor on the phone.
- A 2022 EyeVerify (now Jumio) patent, US11341880B1, compares frame brightness with the ambient light sensor.
- arXiv 2605.00218 uses the accelerometer: motion traces recorded during selfie capture serve as extra evidence against spoofing.
Why does it matter? Injection attacks are common on the web and on rooted Android devices, but they work on iOS too (check out the iProov Threat Intelligence Report 2026). If attackers manage it, they feed in either a pre-recorded video of the real victim or one generated from a single photo of them.
The only documented path today runs through a jailbreak (as far as I know). Public jailbreaks reach iOS 17.3.1 on devices up to the iPhone 15 Pro, and iOS 18.7.1 on older models like the XS (see the full table). With a rootless jailbreak such as Dopamine plus RootHide, typical jailbreak checks see nothing. I’ve reproduced this myself and managed to inject a video :) Still, finding a device with the right model and iOS version isn’t easy. The cheapest defense is your deployment target: if your app requires iOS 26 or later, it won’t run on any publicly jailbreakable device (for now).
Before You Go
Back to the PDF story: Calif followed up with another post. This time the PDF runs its own code (one, two) and gets jailbreak-like behavior on an iPhone 18 Pro with iOS 27.0.1 (three).
And then iPhone Duo.
Then they showed it works even with Lockdown Mode enabled and survives an upgrade to iOS 27.2 (Privacy Guides).
I’ll keep following them, but I doubt they will release it publicly.
That’s it for #0. If you found it useful, forward it to one colleague. Reply and tell me what you’d like me to cover next :)
See you in #1.