USENIX Paper Maps Gray Market for Unauthorized iOS Apps via Ad Hoc Distribution

A USENIX Security 2026 paper from Tsinghua University's NISL laboratory finds that Apple Ad Hoc distribution has been commercialized to install unauthorized iOS apps at scale. Researchers catalogued 3,359 active signing sites, 8,216 unauthorized IPA records, and modified copies of popular apps that introduce privacy and unauthorized-operation risks.

A study by the NISL laboratory, to appear at USENIX Security 2026, examines how Apple's official Ad Hoc distribution channel has been used at scale to install unauthorized iOS apps outside the App Store. The paper, titled "Cracks in the Walled Garden: Dissecting the Gray-Market of Unauthorized iOS App Distribution via Ad Hoc Sideloading," finds that abuse of Ad Hoc distribution has grown into a gray-market chain covering developer certificate resale, signing tools, app repositories, and promotion. Apps that reach users are often modified VIP or ad-free versions of popular titles and can introduce privacy, account, and unauthorized-operation risks.

iOS signing and official distribution

On iOS, apps cannot be installed without a valid signature. Developers sign apps with Apple developer certificates and use provisioning profiles to specify allowed devices and permissions. At install time, iOS checks that the signature is valid, that the app has not been tampered with, and that the device is eligible.

Figure 1: iOS app signing and installation flow

Apple provides several official distribution paths. The App Store is for public release. TestFlight is for testing. In-House is for enterprise internal deployment. Ad Hoc lets developers install test apps on specific devices registered in advance.

Researchers note that channels allowing install outside the App Store have been reused before. Enterprise certificates, TestFlight, free developer accounts, jailbreaks, and TrollStore have all been used for unofficial distribution, typically with short validity, easy revocation, or dependence on particular system versions. Ad Hoc distribution is intended for pre-registered test devices, can remain valid for up to one year, and is tied to a developer certificate and the device UDID. The paper says those properties made it easier to package as a stable commercial service, which is why the gray market focused on this channel.

Figure 2: Common iOS sideloading methods and validity periods

Scale of the gray market

Researchers collected data by starting from social media promotions and expanding to sites, tools, and app libraries. They identified 62 signing sites promoted on social media and, using domain patterns and passive DNS, expanded that set to 3,359 active signing sites. From those sites they obtained 2,118 signing tools and analyzed 12 representative tools. From the tools they extracted 14 IPA repositories, collected 8,216 unauthorized IPA records, and downloaded and analyzed 2,654 IPA files. The authors conclude the activity is large and ongoing rather than isolated.

Figure 3: Obtaining a device UDID through a signing site

Figure 4: Signing tools offering IPA repositories and custom signing

Certificate resale chain

The paper describes a divided supply chain for developer certificates. Upstream actors obtain or recycle Apple developer accounts, some of which circulate for about 900 to 1,000 yuan. Certificate sites then use those accounts to generate certificates and profiles in bulk. Signing sites package the credentials as consumer services. Social media agents handle promotion, customer acquisition, and payment.

An Apple individual developer account costs 99 US dollars per year. After markups by certificate sites, signing sites, and agents, end users often pay 30 to 100 yuan. The paper estimates markups of 900 percent to 3,000 percent. The authors say high margins and automated tools that lower the skill barrier have supported continued expansion.

Figure 5: Layered certificate resale chain

Signing tools and distributed apps

Reverse analysis of 12 representative tools found highly similar implementations. Several custom tools contained functions related to the open-source project zsign. Besides certificate management and signing, tools supported changes to app name, icon, and Bundle ID, and injection of extra dynamic libraries. Some so-called permanent editions were found to extend app lifetime by abusing iOS flaws. The paper treats these tools as infrastructure for unauthorized distribution.

Figure 6: Zsign is an open-source signing tool

Most circulated apps were modified versions of popular software rather than original titles. From 8,216 IPA records the authors extracted 1,883 base apps; 79.6 percent had matching official versions on the App Store. Common targets included WeChat, Xiaohongshu, Douyin, TikTok, Bilibili, and Spotify. The most common modifications were VIP unlocks and ad removal.

From 2,654 apps the researchers extracted 8,085 third-party dynamic libraries that can intercept and change in-app behavior. Users therefore install a third-party modified binary rather than the App Store-reviewed original.

For WeChat, the paper groups observed risk into three categories. Unauthorized operations include simulated messaging, automatic group joins, forged location, altered fitness data, and triggering of payment-related interfaces. Sensitive data exposure includes reading live messages, WeChat IDs, and contact lists, with some code observed uploading chat content to third-party servers under certain conditions. System capability abuse includes changing app configuration to enable native camera, CallKit, or background execution beyond original app and system boundaries.

VirusTotal scans of the 8,085 third-party libraries flagged only 3 as malicious. The authors stress that a clean scan does not mean the modified app is safe, because many risks come from changed access to legitimate app functions and data rather than conventional malware.

Defenses

The paper argues user advice alone is insufficient. It recommends that Apple increase monitoring of developer certificates and abnormal distribution; that social platforms act on promotional content and related domains; and that app developers detect abnormal code injection, tampering of critical logic, and sensitive operations.

Paper: https://www.usenix.org/system/files/usenixsecurity26-liu-yijing.pdf

Lead author Liu Yijing is a fourth-year Ph.D. student at the Institute for Network Sciences and Cyberspace, Tsinghua University, advised by Associate Professor Liu Baojun. Research focus is internet crime governance.