It be your own people
Certo has discovered that online criminals are offering keylogger services for those who want to keep tabs on someone they know. For as low as $30, people can install a malicious app with a third-party keyboard on someone’s phone covertly.
The keylogger-laced keyboard records and sends all the inputs made by the victim. This gives the hacker and the abettor access to messages, the names of the websites the target visited, two-factor authentication codes, and passwords.
Since the apps are distributed through TestFlight, they avoid the strict process that apps meant for the App Store go through.
Default iPhone keyboard vs custom keyboard with keylogger
The custom keyboards look the same as the default iPhone keyboard so most people won’t realize that something fishy is up. The only way to check for them is by navigating to Settings, then tapping on General, then selecting Keyboard, and then going to Keyboards.
If you see a third keyboard in addition to ‘English (US)’ and ‘Emoji’ that you don’t remember installing, you should get rid of it by tapping on ‘Edit’ and selecting ‘Delete.’
Certo came to know about this campaign when it heard of multiple cyberstalking incidents where stalkers knew everything that a victim had typed into their phone.
