In 2022, a version of “iPhone GSM Tool v24” was analyzed by cybersecurity firm Malwarebytes. The installer dropped a hidden process called syshelper.exe that connected to a command-and-control server in Eastern Europe. It harvested saved passwords from Chrome and Firefox.