Beware, iPhone users: First-ever iOS GoldDigger trojan can steal face ID and bank accounts

I'm not one to make fun of someone's grammar online, but it seems as though your phone was infected by the Trojan. You should have it looked at.

When someone is as ignorant as u and has nothing good to say maybe its better if u just keep quiet instead u sound stupid. No offense n this case ur brain was affected.

People need to learn the difference between secure and obscure.

They seem pretty close, but Apple being more closed off isn't a reflection of the OS itself being secured. It's just more hard to reach.

End of the day, if an iOS person is gonna be giving away a password to a random chat rep, clicking dodgy links, they will all fall victim to cyber theft (these are mainly how your data gets into the wrong hands)

Falsy associating iOS as some added security doesn't address that the main vulnerability was the user to begin with.

Martin and Anam must be pissing their pants!

I look forward to Martin's article about how this is bad for Samsung

As a software engineer with over 30 years of experience, including positions with major phone makers, you’re only partially right. Architecturally, the app sandbox in iOS has stepper fences than in Android. And it seems that Google resists raising the fences around the app sandbox because it would make things harder for its big data vacuum cleaner that feeds its utmost business: selling ads.

"But that might not be the case anymore"

NO, it was NEVER the case, ios is slightly more secure because is a more limited operating system and this come with a downside for legit apps too not only malware especially in the past.

And the 2nd reason for being less targeted is because it has a small marketshare compared to android so it makes more sense to target android if you want to infect as many devices as possible.

It's only third party apps that are sandboxed.

The pivot from abusing TestFlight to social-engineering victims into installing rogue Mobile Device Management (MDM) profiles is genuinely alarming. Enterprise MDM profiles are designed to give IT administrators deep device oversight, so once an unsuspecting user approves that certificate, Apple’s walled-garden sandboxing is essentially neutralized.

What really stands out, though, is how attackers harvest facial recognition data specifically to feed AI deepfake engines for banking bypasses. In our office lab, we run threat modeling and synthetic media detection tests across a staging cluster powered by an enterprise 48-core Xeon processor clocked at 2.1GHz. Watching how modern generative algorithms process facial meshes across parallel compute pipelines proves just how accessible believable impersonation has become. When threat actors can pair real-time synthetic face models with intercepted SMS one-time codes, traditional mobile banking authentication completely collapses.

With mobile banking increasingly nudging users toward biometric face-matching for large transfers, do you think financial institutions will be forced to drop facial verification entirely, or can client-side liveness detection evolve fast enough to stay ahead of deepfakes?