Unit 42 has recently identified malware exploiting an attack technique we have named “BackStab,” in which attackers can capture private information from backup files stored on a Windows PC or Macintosh. Under default conditions, iOS devices plugged into a computer running iTunes may create an unencrypted backup file that contains many types of private information. Forensics experts have known about these backups for years and have used them to capture phone data without requiring direct access to the phone. We have found that malicious attackers are now using malware to steal data using this same technique.