| Indicator | Verdict | |-----------|---------| | Domain reputation | Poor (associated with adware campaigns) | | SSL certificate | Self-signed or Let’s Encrypt issued to non-corporate entity | | File behavior | Installs global proxy and custom certificate | | VT detection rate | 12/65 security vendors flag as "Malicious" or "PUP" (Potentially Unwanted Program) |
In the world of mobile device management (MDM) and enterprise security, configuration profiles ( .mobileconfig files) are essential tools. However, they are also increasingly used as attack vectors for malware, ad fraud, and phishing. One specific string has been appearing in server logs, forum discussions, and security alerts: id.codevn.net ch play.mobileconfig . id.codevn.net ch play.mobileconfig
