The implant is gone, but the attacker still has keychain data and can/did/does use it to continue downloading data in clear text: “The implant uploads the devi

The implant is gone, but the attacker still has keychain data and can/did/does use it to continue downloading data in clear text: “The implant uploads the device's keychain, which contains a huge number of credentials and certificates used on and by the device. ... The keychain also contains the long-lived tokens used by services such as Google's iOS Single-Sign-On to enable Google apps to access the user's account. These will be uploaded to the attackers and can then be used to maintain access to the user's Google account, even once the implant is no longer running. ... There's something thus far which is conspicuous only by its absence: is any of this encrypted? The short answer is no: they really do POST everything via HTTP (not HTTPS) and there is no asymmetric (or even symmetric) encryption applied to the data which is uploaded. Everything is in the clear.” (Source: https://googleprojectzero.blogspot.com/2019/08/implant-teardown.html?m=1 https://googleprojectzero.blogspot.com/2019/08/implant-teard...)