Resources for iOS security

Table of Contents

Here you can find resources I’ve found interesting and useful while learning more about iOS security. Don’t hesitate to send me more resources!

Links
#

Resources are grouped by year, newest first. Publisher and format are shown on each card.

2026
#

ZygoSecArticle

Uncovering an iOS 26 ImageIO Vulnerability

Related POC

ironPeakArticle

Pardon MIE?

Google Threat IntelligenceArticle

The Proliferation of DarkSword: iOS Exploit Chain Adopted by Multiple Threat Actors

Google Threat IntelligenceArticle

Coruna: The Mysterious Journey of a Powerful iOS Exploit Kit

SecurelistArticle

Coruna: the framework used in Operation Triangulation

iVerifyArticle

Coruna: Inside the Nation-State-Grade iOS Exploit Kit We've Been Tracking

iVerifyArticle

Coruna iOS Exploit: How to Detect and Prevent Infection

iVerifyArticle

Inside DarkSword: A New iOS Exploit Kit Delivered Via Compromised Legitimate Websites

iVerifyArticle

New DarkSword Exploit Confirms Mass iOS Attacks Are Now a Serious, Wide-Spread Business Risk

Jamf Threat LabsArticle

Predator's kill switch: undocumented anti-analysis techniques in iOS spyware

Muirey03Write-up

CVE-2025-43520.txt

vphoneWrite-up

super-tart-vphone-writeup

vphoneTool

vphone-cli

matteyeuxArticle

Coruna: how a simple web link takes full control of your iPhone

LailoArticle

Deep dive and technical analysis of the Coruna exploit framework

ApplePDF

Apple Platform Security

Lookout Threat LabsArticle

Lookout Uncovers DarkSword iOS Exploit Chain, Exposing a New Era of Mobile Threats

Jamf Threat LabsArticle

How Predator spyware defeats iOS recording indicators

Jamf Threat LabsArticle

Inside Predator's kernel engine

NDSS SymposiumPaper

CHAMELEOSCAN: Demystifying and Detecting iOS Chameleon Apps via LLM-Powered UI Exploration

NDSS SymposiumPaper

Starshields for iOS: Navigating the Security Cosmos in Satellite Communication

IEEE S&PPaper

Auditing Apple’s DifferentialPrivacy.framework: Implementation Bugs, Misconfigurations, and Practical Risks

USENIX SecurityPaper

Cracks in the Walled Garden: Dissecting the Gray-Market of Unauthorized iOS App Distribution via Ad Hoc Sideloading

CalifArticle

Reverse Engineering Apple's Silent Security Fixes

CalifArticle

Taking Apart iOS Apps: Anti-Debugging and Anti-Tampering in the Wild

ret2p.ltArticle

CVE-2026-28956 - 'Requiem'

FuzzingLabsSlides

Navigating the MTE Landscape: iOS Memory Protection Deep Dive

Apple Security ResearchArticle

A blueprint for formal verification of Apple corecrypto

zeroxjfPOC

AGX Barrier-Mask Panic

zeroxjfPOC

CVE-2026-20687: AppleJPEGDriver startDecoder() Timeout UAF

zeroxjfPOC

CVE-2026-28992: IOHIDFamily FastPathUserClient Race Conditions

zeroxjfPOC

AppleKeyStoreUserClient close() UAF

zeroxjfPOC

SEP Exhaustion Kernel Panic

zeroxjfPOC

CVE-2026-20637: AppleSEPKeyStore Use-After-Free

zeroxjfPOC

WebKit-UAF-ANGLE-OOB-Analysis

2025
#

Google Project ZeroArticle

Blasting Past WebP: An analysis of the NSO BLASTPASS iMessage exploit

Google Project ZeroArticle

Pointer leaks through pointer-keyed data structures

Google Threat IntelligenceArticle

Sanctioned but Still Spying: Intellexa's Prolific Zero-Day Exploits Continue

Related sample L0psec reverse

Citizen LabArticle

Sweet QuaDreams or Nightmare before Christmas? Bill Marczak on Dissecting an iOS 0-Day

SynacktivArticle

iOS 18.4 - dlsym considered harmful

QuarkslabArticle

First analysis of Apple's USB Restricted Mode bypass (CVE-2025-24200)

QuarkslabArticle

Reverse engineering of Apple's iOS 0-click CVE-2025-43300: 2 bytes that make size matter

iVerifyArticle

iVerify uncovers NICKNAME zero-click iMessage exploit

iVerifyArticle

Trust Broken at the Core

Matthias FrielingsdorfVideo

Predator Malware: Trust Broken At The Core

Epsilon's blogArticle

Technical analysis of CVE-2025-31201

Dataflow SecurityArticle

Depicting an iOS Vulnerability

Dataflow SecurityArticle

Blasting Past iOS 18

Apple SEARArticle

Memory Integrity Enforcement: A complete vision for memory safety in Apple devices

Alfie CGArticle

Trigon: developing a deterministic kernel exploit for iOS (part 1)

Alfie CGArticle

Trigon: exploiting coprocessors for fun and profit (part 2)

noahhwArticle

CVE 2025 31200

Exploit ReversingPDF

Exploiting Reversing (ER) series: Article 04 (macOS/iOS - part 01)

Research paperPaper

Modern iOS Security Features: A Deep Dive into SPTM, TXM, and Exclaves

DarkNavyTalk

DNGerousLINK: A Deep Dive into WhatsApp 0-Click Exploits on iOS and Samsung Devices

2024
#

SecurelistVideo

Caught in the wild, past, present and future by Clem1

SynacktivSlides

Escaping the Safari sandbox: A tour of WebKit IPC

Objective by the SeaPlaylist

Objective by the Sea v7.0 playlist

iVerifyArticle

Clipping Wings: Analysis of a Pegasus spyware sample

iVerifyArticle

LightSpy iOS spyware

Matthias FrielingsdorfVideo

From Pegasus to Predator: The evolution of commercial spyware on iOS

Matthias FrielingsdorfVideo

You Shall Not PASS: Analysing a NSO iOS spyware sample

Alfie CGArticle

A step-by-step guide to writing an iOS kernel exploit

cat/dev/brainArticle

Reverse engineering the iOS 18 Inactivity Reboot

Jamf Threat LabsArticle

CVE-2024-44131 TCC bypass (unauthorized iCloud access)

R00tkitsmmArticle

ImageIO, the infamous iOS zero-click attack vector

R00tkitsmmArticle

Pishi: Coverage guided macOS KEXT fuzzing

TFP0 LabsArticle

Extracting Sandbox Profiles on iOS with SandBlaster

Lukas ArnoldSlides

Busting Rogue Base Stations using CellGuard and the Apple Cell Location Database

2023
#

Google Project ZeroArticle

An analysis of an in-the-wild iOS Safari WebContent to GPU Process exploit

Citizen LabArticle

Predator in the Wires: Ahmed Eltantawy targeted with Predator spyware after announcing presidential ambitions

Citizen LabArticle

Triple Threat: NSO Group's Pegasus spyware returns in 2022 with a trio of iOS 15 and iOS 16 zero-click exploit chains

SecurelistArticle

Dissecting TriangleDB, a Triangulation spyware implant

SecurelistArticle

Operation Triangulation: The last hardware mystery

HEXACONVideo

The two-sided mirror by xerub

HEXACONVideo

Finding and exploiting an old XNU logic bug by Eloi Benoist-Vanderbeken

Objective by the SeaPlaylist

Objective by the Sea v6.0 playlist

Matthias FrielingsdorfVideo

Current State of iOS Malware Detection

Apple SEARArticle

What if we had the SockPuppet vulnerability in iOS 16?

Google TAGArticle

0-days exploited by commercial surveillance vendor in Egypt

PKSecurityArticle

Root cause analysis of CVE-2023-32439 (WebKit type confusion)

Jamf Threat LabsArticle

WebKit vulnerability CVE-2022-42856 explained

Jamf Threat LabsArticle

The Web of Connections with iOS 16.4.1

2022
#

Google Project ZeroArticle

An Autopsy on a Zombie In-The-Wild 0-day

Google Project ZeroArticle

CVE-2021-1782, an iOS in-the-wild vulnerability in vouchers

Google Project ZeroArticle

CVE-2021-30737, @xerub's 2021 iOS ASN.1 Vulnerability

Google Project ZeroArticle

FORCEDENTRY: Sandbox Escape

Google Project ZeroSlides

A Brief History of iMessage Exploitation

HEXACONVideo

Life and death of an iOS attacker by Luca Todesco

SynacktivSlides

Attacking Safari in 2022

Objective-SeeArticle

SeaFlower

Objective by the SeaPlaylist

Objective by the Sea v5.0 playlist

StarlabsArticle

Apple CoreText: An Unexpected Journey to Learn about Failure

2021
#

Google Project ZeroArticle

A Look at iMessage in iOS 14

Google Project ZeroArticle

A deep dive into an NSO zero-click iMessage exploit: Remote Code Execution

Citizen LabArticle

FORCEDENTRY: NSO iMessage zero-click exploit

Citizen LabArticle

Pegasus vs. Predator: Dissident's doubly-infected iPhone reveals Cytrox mercenary spyware

Amnesty InternationalReport

Forensic Methodology Report: How to catch NSO Group's Pegasus

SynacktivArticle

Analysis and exploitation of the iOS kernel vulnerability CVE-2021-1782

Objective by the SeaArticle

Analysis of CVE-2021-30860

Objective by the SeaPlaylist

Objective by the Sea v4.0 playlist

2020
#

Google Project ZeroArticle

Remote iPhone Exploitation Part 1: Poking Memory via iMessage and CVE-2019-8641

Related Samuel Gross talk

Google Project ZeroArticle

Fuzzing ImageIO

Google Project ZeroArticle

Fuzzing iOS code on macOS at native speed

Google Project ZeroArticle

Remote iPhone Exploitation Part 2: Bringing Light into the Darkness - a Remote ASLR Bypass

Google Project ZeroArticle

Remote iPhone Exploitation Part 3: From Memory Corruption to JavaScript and Back - Gaining Code Execution

Google Project ZeroArticle

A survey of recent iOS kernel exploits

Google Project ZeroArticle

An iOS zero-click radio proximity exploit odyssey

Citizen LabArticle

The Great iPwn: Journalists hacked with suspected NSO Group iMessage zero-click exploit

Objective by the SeaPlaylist

Objective by the Sea v3.0 playlist

2019
#

Google Project ZeroArticle

A very deep dive into iOS exploit chains found in the wild

2016
#

Razvan Deaconescu et al.Paper

SandBlaster: Reversing the Apple Sandbox

Ongoing references
#

8kSecIndex

iOS Security Blogs

8kSecSeries

ARM 64 Reversing and Exploitation Series

Billy EllisChannel

YouTube channel - @BillyEllis

blacktopSocial

X - @blacktop__

Links#

2026#

2025#

2024#

2023#

2022#

2021#

2020#

2019#

2016#

Ongoing references#

Links
#

2026
#

2025
#

2024
#

2023
#

2022
#

2021
#

2020
#

2019
#

2016
#

Ongoing references
#