While Android banking trojans are typically distributed through malicious apps and phishing attacks, getting a trojan onto an iPhone is a bit more difficult due to how Apple’s ecosystem is much more closed off than Google’s. Still, like they often do, hackers have found a way.

During the beginning of this malware campaign, the hackers behind it leveraged Apple’s mobile application testing platform TestFlight to distribute the GoldPixaxe.IOS trojan. It’s extremely difficult to get a malicious app onto Apple’s App Store but by abusing the iPhone maker’s TestFlight program, it is possible. This worked at the start of the campaign but once this malicious app was removed from TestFlight, the hackers behind this campaign had to come up with a more sophisticated means of distributing their iOS trojan.

With TestFlight access revoked, the hackers used social engineering to persuade their victims into installing a Mobile Device Management (MDM) profile. For those unfamiliar, MDM is a methodology and set of tools used by a business’ IT department to manage company phones, computers and other devices. If a victim did fall for this new tactic, the end result was that the hackers now had complete control over their iPhone.

Vietnam and Thailand only. Everyone else, don’t agree to sideload something prompted by a guy on the phone.