iOS 0-Day, 55M U.S. Citizens’ Data, and Stealer Tools Hit Dark Web Forums

According to SOCRadar, a surge in underground listings shows an alleged iOS 18.x.x zero-day remote code execution exploit, a database claimed to contain 55 million U.S. citizen records, a Discord-focused malware named “Trap Stealer 2025,” and subscription-based access to premium stealer logs being advertised on dark‑web forums.

The threat actor advertising the 55 million records claimed the dataset includes names, phone numbers, dates of birth, addresses, workplace details, Social Security Numbers in about 39 percent of entries, email addresses, ZIP codes, gender, ethnicity and cookies, with data said to have been collected between May and August 2025 and negotiable via Telegram or forum messages.

A SQL Server 0‑Day (CVE-2025-49719) and other zero-days were cited as methods used to obtain the database, while the iOS exploit post claimed it would enable full device compromise with root privileges and persistence across reboots. Another listing offered access to over 10,000 stealer log files from more than 30 premium channels, with subscriptions at $50 per month.

The Trap Stealer 2025 tool was described as fully undetected and capable of stealing credentials, cookies, browser passwords, autofill data and clipboard content, and targeting numerous services including Discord, Spotify, and TikTok. Published on 8 September 2025, the report highlights how such tools and data are being traded at scale within the evolving cybercrime economy.