What happens when a security researcher downloads a dating app, a fitness tracker, or a food delivery app from the App Store and starts pulling it apart? In this live session, you'll find out — no slides, no theory, no mercy.
I'll take a real social or lifestyle iOS application, download it, and perform a full static security analysis live. You'll watch as graphic assets ready for phishing clones, authentication tokens left in the open, interface files that reconstruct the entire UI, and downloadable resources that can be hijacked surface in minutes. Then, for a bonus round, we'll walk through how an attacker assembles these pieces into a convincing fake app designed to steal user credentials.
What you'll walk away with: — How attackers build phishing clones from assets inside legitimate app binaries — What exposed authentication tokens and social media credentials look like in practice — Why your UI design files and graphic assets are a security risk, not just a design deliverable — How on-demand resources and interface files become tools for social engineering.
Who this is for: mobile developers, startup founders, UI/UX designers, security engineers, and anyone interested in understanding how everyday app assets get repurposed for identity theft.
About the host: Sergii Koval — 15+ years in iOS/macOS security. Security architect for banking and enterprise platforms. Creator of Threat Explorer, a proprietary iOS security analysis platform. Based in Luxembourg.
Format: Live demo via Google Meet. ~60 minutes. Free. Recorded for YouTube. This is part of a monthly series. Each session, a different industry goes on the table.
