Phenakite
MITRE ATT&CK: S1126 View on attack.mitre.org
Aliases: Dakkatoni, Phenakite
- First seen
- 2021-06-01 00:00:00
- Malware type
- spyware, trojan
- Family
- Malware family
- Operating systems
- ios
- Related IoCs
- 2 (2 malicious)
- Last IoC activity
- 2026-10-03 12:53:18
- Profile updated
- 2026-07-07 13:19:38
Targeted industries: government-and-public-sector media-and-entertainment technology-and-telecommunications
Targeted regions: country_code:ps country_code:il
Context
Phenakite is a mobile malware that is used by APT-C-23 to target iOS devices. According to several reports, Phenakite was developed to fill a tooling gap and to target those who owned iPhones instead of Windows desktops or Android phones.
Recent IoC activity
2 malicious indicators in Maltiverse are attributed to Phenakite (S1126). The 2 most recently updated:
| Type | Indicator | Updated | Sources |
|---|---|---|---|
| file sample | c9437e5334f0ecbce5bba29e7d4236637b120abb63f6714f4241a18bb1a28ffb | 2026-10-03 | 2 |
| file sample | 02091fa0b2277d17481f6f476d5076a2c460e39ee9db3ec6a44fa9365eca14ba | 2026-09-15 | 2 |
Malware & tools used
- SMS Messages (attack-pattern)
- Match Legitimate Name or Location (attack-pattern)
- Data from Local System (attack-pattern)
- Ingress Tool Transfer (attack-pattern)
- Audio Capture (attack-pattern)
- Input Capture (attack-pattern)
- System Information Discovery (attack-pattern)
- Video Capture (attack-pattern)
- Contact List (attack-pattern)
- Exploitation for Privilege Escalation (attack-pattern)
Used by threat actors
- APT-C-23 (threat-actor)
Reports & references
- web.archive.org — Technical Threat Report Arid Viper April 2021 (report)
- web.archive.org — The Israel Hamas War Cyber Domain State Sponsored Activity Of Interest (report)
- malpedia.caad.fkie.fraunhofer.de — Ios.Phenakite (report)
- malware4all.blogspot.com — Grab Your Own Copy Phenakite Ios (report)
- MITRE ATT&CK — S1126 (report)