MalwareUsed by 1 actor

Phenakite

Phenakite is a custom iOS surveillance implant associated with the Arid Viper threat actor, also tracked as Desert Falcon and APT-C-23. It represents the group’s notable expansion into iOS operations and was used in targeted cyber-espionage activity primarily against Palestinian targets, including government officials, Fatah members, student groups, and security personnel. The implant was embedded in a trojanized but functional chat application built from open-source chat code and relied heavily on social engineering for installation.

Phenakite could be installed on non-jailbroken iPhones by persuading victims to install a mobile configuration profile and a device-specific signed application. After installation, it used bundled public jailbreak tooling to elevate privileges and gain access to data beyond normal iOS app permissions. Reported capabilities include collecting device metadata, reading SMS messages, exfiltrating contacts, retrieving photos, collecting and forwarding WhatsApp media, and stealing selected document types and other files from the device. It also supported audio surveillance, including silent recording and phone-call audio capture, and could take photos with the device camera. In addition to on-device collection, the implant could redirect victims to phishing pages for Facebook and iCloud credential theft during the chat application sign-up flow.

Phenakite appears to have been used sparingly rather than at scale. Its deployment reflects Arid Viper’s long-running emphasis on mobile espionage, social-engineering-driven delivery, and surveillance of politically relevant targets in the Middle East.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

Arid Viper

We call this iOS component Phenakite due to it being rare and deriving its name from the Greek word Phenakos, meaning to deceive or cheat.

via facebook securityabout.fb.com

MITRE ATT&CK

Techniques & procedures

16 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

3 techniques

T1189Drive-by CompromiseEvidence2

Android malware was typically hosted on convincing looking attacker-controlled phishing sites. At the time of this writing, we discovered 41 such sites.

T1566PhishingEvidence2

It used sprawling infrastructure to support its operations, including over a hundred websites that either hosted iOS and Android malware, attempted to steal credentials through phishing or acted as command and control servers.

T1566.002Spearphishing LinkEvidence1

This spike in account creation towards the later half of 2019 was observed alongside an increase in attempts to distribute both iOS and Android malware as well as phish credentials from users.

Execution

2 techniques

T1204User ExecutionEvidence1

In all cases the successful installation of these tools did not require any exploits. This suggests that Arid Viper operators continue to heavily rely on social engineering to distribute their malware.

T1204.002Malicious FileEvidence2

They also bundled Windows malware in the installer package for their own decoy application for journalists to submit human rights-related articles for publication.

Privilege Escalation

1 technique

T1068Exploitation for Privilege EscalationEvidence2

Post-installation, a jailbreak was necessary for the malware to elevate its privileges to retrieve sensitive user information not accessible via standard iOS permission requests. This was achieved with the publicly available Osiris jailbreak that made use of the Sock Port exploit.

Stealth

2 techniques

T1036MasqueradingEvidence2

This malware masqueraded as secure chat applications.

T1211Exploitation for Defense EvasionEvidence1

Phenakite comes bundled with the publicly available Osiris jailbreak and also includes the Sock Port exploit.

Credential Access

2 techniques

T1056Input CaptureEvidence1

This malware could also direct people to phishing pages for Facebook and iCloud to steal their credentials for those services.

T1528Steal Application Access TokenEvidence2

This malware could also direct people to phishing pages for Facebook and iCloud to steal their credentials for those services.

Collection

4 techniques

T1005Data from Local SystemEvidence3

Retrieve photos from the camera roll ... Retrieve contacts ... Retrieve text messages ... Search for and return the path of files with a doc or PDF extension

T1056Input CaptureEvidence1

This malware could also direct people to phishing pages for Facebook and iCloud to steal their credentials for those services.

T1123Audio CaptureEvidence1

Phenakite periodically recording audio and notifying C2 infrastructure... Similarly, Phenakite periodically uses the camera of a compromised device to take photos

T1125Video CaptureEvidence1

Phenakite periodically uses the camera of a compromised device to take photos and sends these automatically to attacker infrastructure.

Command and Control

1 technique

T1071Application Layer ProtocolEvidence2

Once collected, the malware would upload the data to Firebase, a mobile app development platform.

Exfiltration

1 technique

T1041Exfiltration Over C2 ChannelEvidence4

Examples in the content include: 'Riltok can access and upload the device's contact list to the command and control server,' 'Rotexy can access and upload the contacts list to the command and control server,' and multiple entries stating malware can 'exfiltrate' contacts.

Other

1 technique

T1656ImpersonationEvidence1

It relied on social engineering to trick people into clicking on malicious links and installing malware on their devices.

INDICATORS OF COMPROMISE

IOCs tracked for this family

9 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

7 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

2 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting

domain●●●●●●●●●●●●View more in app—

ACTIVITY FEED

Recent activity

15 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

15 SOURCESView more in app

sentinelone labsNews

Apr 11, 2025

Arid Viper | APT’s Nest of SpyC23 Malware Continues to Target Android Devices | SentinelOne

A short-lived iOS implant associated with Arid Viper.

ptsecurity globalNews

Oct 26, 2024

Analytics

iOS spyware capable of recording calls, stealing WhatsApp media, photos, selected files, and redirecting victims to phishing pages to steal credentials.

malpediaNews

Dec 14, 2023

AridViper (Threat Actor)

Phenakite is identified as a named iOS malware sample/family.

facebook securityNews

Apr 21, 2021

Taking Action Against Hackers in Palestine

Custom-built iOS surveillanceware used by Arid Viper. It was trojanized inside a functional chat app, required installation via a mobile configuration profile, and after jailbreak-based privilege escalation could retrieve sensitive user information and direct victims to Facebook and iCloud phishing pages.

+11 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching9

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping16

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Phenakite