Clop has discovered what life is like on the receiving end of an extortion demand after rival crew ShinyHunters hijacked its leak site and demanded an eight-figure payout. The takeover surfaced over the weekend, when Clop's dark web leak site displayed a large "DOMAIN SEIZED BY SHINYHUNTERS" banner and the tagline "rooting your systems since '19 ;)." ShinyHunters told Reuters that it broke into the site on Friday by exploiting a vulnerability in the software powering it. The crew claimed this gave it extensive access to Clop's infrastructure. "We basically own them now," it said. Clop has not responded publicly, although two security researchers told Reuters that the clash appeared genuine. The Register has also viewed the defaced site, where ShinyHunters is posting increasingly colorful demands. According to ShinyHunters, the feud dates back to Clop's attacks on Oracle E-Business Suite (EBS) customers last year. ShinyHunters claims it discovered the zero-day first, only for Clop to obtain the exploit and use it against corporate networks. It now wants a share of the proceeds. In a message posted on September 19, ShinyHunters demanded an eight-figure payment, claiming the sum represented 2.333 percent of its own net worth. A later update raised the demand to "all the money you made off the EBS campaign plus more AND WITH INTEREST." ShinyHunters also threatened to identify companies that allegedly paid Clop and publish the sums and Bitcoin addresses involved. ShinyHunters turned the screw again on September 21, warning that its demands would increase with every 24 hours that Clop failed to respond. It now also wants a public apology, because apparently having your dark web extortion site hijacked isn't embarrassing enough. Clop is one of the most prolific data extortion groups in cybercrime. The gang has spent years exploiting vulnerabilities in enterprise software to steal data and extort victims, most notoriously during the 2023 MOVEit campaign, which affected thousands of organizations and exposed information belonging to tens of millions of people. ShinyHunters has an extensive rap sheet of its own, having been linked to numerous large-scale data theft and extortion campaigns. Its latest target is rather more familiar with that business model than most. The potential damage to Clop goes beyond the defacement of its leak site. If ShinyHunters has the wider access it claims and publishes records of previous ransom payments, the fallout could extend to companies that believed paying Clop had kept their identities and negotiations private. For now, though, those claims remain unverified. There is also the small matter of Clop's reputation. Leak sites are intended to demonstrate that an extortion crew has both the stolen goods and control of its operation. Having yours hijacked by a rival and repurposed to demand money from you is not exactly a glowing advertisement. ShinyHunters says the price will continue rising every 24 hours until Clop responds. The extortionists have become the extorted. ®
The Rust project has warned that attackers appear to be targeting its contributors and crate owners in an attempt to compromise their devices and accounts, potentially allowing malware to be distributed through its package ecosystem. Posting to the Rust blog, security-focused software engineer Adam Harvey said the tactics resemble those used in North Korean fake recruiter campaigns. "A video call is set up for something positive – maybe for a job, maybe for a project, maybe for a contract opportunity – and then that's used as a vector to either get the target to install something on their computer (such as a purportedly missing audio codec) or execute another command (for example, via putting a command on the clipboard)," Harvey wrote. "These attackers are setting up new but legitimate-seeming company profiles, including plausible LinkedIn presences, in order to pass cursory inspection." The warning follows several attacks targeting the Rust community over the summer. In June, Rust developers were targeted with fake interview approaches purporting to come from a Singaporean venture capital firm. Matt Mastracci, who maintains packages on Rust's crates.io registry, said the supposedly recruiting business turned out to be defunct. The initial approach nevertheless appeared convincing and almost led to his machine being infected with a remote access trojan (RAT). The attempted deployment of a RAT resembles activity described in an international advisory issued last week by agencies in Australia, Germany, Japan, and the US. The advisory said North Korean operators had used fake job interviews to compromise more than 30,000 devices and steal over $10 million. Separately, Rust's package ecosystem suffered a supply chain attack in August, when malicious versions of the arrayref crate were published that downloaded malware onto users' machines. Arrayref had recorded 245 million downloads over its lifetime, although the malicious releases were available for less than two hours. The evidence suggested that a maintainer's credentials had been compromised rather than the malware being deliberately introduced by the project's developers. Harvey urged Rustaceans to scrutinize unsolicited approaches even when the sender appears legitimate, and to conduct calls through trusted platforms. ®
Author here. The post describes three memory-safety bugs which have been in Godot since v1.0 and v3.0. All three are still present in current releases. The bugs can affect exported games that load community-authored data files. Godot allows attackers using maliciously crafted files to trigger reads or writes past the end of a buffer, inside the process running the game. The post includes the response from Godot maintainers who deny this is a security issue, and my reply to them. Happy to give more information about the bugs or the audit if there are questions.
I have been developing a tool wrapped around tshark. The first blog post was about hitting a wall on a 2.5 GB file. Later, I talked about parallelizing the PCAP processing in my second blog post where I ran into a file corruption bug. I was using PcapSplitter from PcapPlusPlus in connection mode and output started coming back corrupted.
The initial signal came from "Total Block Length" errors thrown by tshark on some output files. The actual signal came when I built a small reproduction. PcapSplitter reported 12 files and 48 packets, but on disk, there were 11 files and 44 packets. Exit code zero and printed "Finished" on standard output.
Two wrong theories first. Someone on Reddit suggested file descriptor exhaustion. It was plausible but I found that at low ulimit -n it silently drops most packets and still exits zero. A real bug, but not mine. Then, I found that the PcapSplitter library has a hardcoded MAX_NUMBER_OF_CONCURRENT_OPEN_FILES = 250 with an LRU that closes and reopens handles past it. My minimal reproduction was 13 connections, nowhere near the cap.
The real culprit: the PcapSplitter's FiveTupleSplitter caused file truncation/corruption on TCP session reuse (i.e., a new SYN packet arrives for an already tracked 5-tuple hash).
The correct part of the splitter was assigning a new file number when a TCP session reuses a 5-tuple, but the filename function builds the name from IP and port only. So, in this case, both sessions get the same filenames. Then main.cpp sees a file number it has never seen, and opens that file fresh, without append. This truncates the existing file or causes a race condition between two active file writer handlers.
I filed the issue with a 13-connection reproduction, the maintainer and I worked out a fix that only suffixes on an actual collision, tested on the same corruption, and now the fix is merged.
AI labs are toying with an industry-wide pact to slow development. Meanwhile, widely available AI chatbots are already helping uncover a tidal wave of security flaws.
When you scroll through your teen’s iPhone during a casual check-in, you might see messaging apps, a few games, school tools, maybe TikTok. Everything looks normal. But what if some of the apps your child uses most aren’t showing up at all? What if that innocent-looking calculator icon is actually a vault for hidden photos, private chats, and secret social media accounts?
This isn’t science fiction or paranoia. Teens now have powerful tools to keep entire corners of their digital lives invisible to parents. Starting with iOS 18, which rolled out in late 2024, iPhone users can now natively lock and hide apps from the Home Screen, search results, and even from obvious parts of the App Library without biometric authentication.
If you suspect your child or teen is hiding apps and engaging in potentially harmful online activities, you may find this guide helpful. We’ll discuss the current digital landscape that threatens children and methods for checking for and uncovering hidden apps. More importantly, we will share insights on how to start conversations with your teens about the risks of hiding apps, and tips on how to keep your child safe from predators and other cybercriminals.
Key Takeaways
Teens hide apps for many reasons, including seeking normal privacy, avoiding conflict over screen time, and concealing genuinely risky behavior such as cyberbullying, sexting, and contacting strangers.
iOS 18’s native hiding features allow users to lock apps behind Face ID and move them to a hidden folder, making casual parental discovery much harder.
Parents can check for hidden apps by reviewing iPhone Storage settings, Screen Time reports, and the App Library’s Hidden folder.
The healthiest approach blends understanding how hiding works with ongoing, honest family conversations and smart use of security tools.
Why Kids and Teens Hide Apps on iPhone
The ability to conceal apps on iPhones has expanded with iOS 18’s native features and disguise vault apps. Teens worldwide can now make entire app categories invisible to parental checks. Before exploring how to uncover hidden apps, it’s important to first understand why children do it. When we grasp their motivations, we are better positioned to respond constructively rather than punitively.
Privacy from Parents and Peers
A study from the Pew Research Center shows that about half of parents in the U.S. look through their teen’s phone. But many teens use hidden apps to keep parts of their social life private: conversations with crushes, embarrassing photos, fan fiction, fake Instagram or finsta accounts where they share unfiltered thoughts.
These patterns reflect global trends as smartphones become central to adolescent identity worldwide, according to Nexus Teen Academy. Hiding isn’t always about danger. Often it’s about autonomy and the universal teenage desire for private space.
Avoiding Screen Time Limits and Parental Controls
In its survey, Pew Research also revealed that around 47% of parents in the U.S. set screen time limits. To circumvent this restriction, some teens find workarounds such as hiding apps to bypass Screen Time, keeping backup social apps off the approved list, or using web browsers instead of installed apps.
Hiding Risky or Sensitive Content
Some teens hide apps or use secondary accounts to disguise risky content or activities they may be involved in, including for sexting, dangerous challenges, or contacting strangers or certain communities. Vault apps may store explicit images or bullying screenshots that teens are ashamed to show adults. Hiding removes early warning signs that could prompt intervention before situations escalate.
The Risks of Hiding Apps
Hidden apps are just one piece of a larger digital reality in which teens spend hours each day online, often beyond adult supervision. To respond effectively, you need to recognize the prevalence and hazards of this trend.
Screen Time and Conflict in Families
Studies show that teens globally spend around 7 hours and 22 minutes looking at device screens daily, 4.8 hours of which are on social media. However, too much time spent on social media has been linked to poor mental health, including symptoms of depression and anxiety. Long screen time was linked to conflict in 38% of families, another survey found.
Mental Health Concerns
When screen time creates constant conflict in the family, hiding apps can feel like a way to keep the peace for teens. This impulse can hide situations that are genuinely harmful to children’s and teens’ mental health and overall well-being. Pediatric health organizations note that unsupervised, high-intensity, and excessive use of social media is linked to increased anxiety, depression, sleep disruption, and body image issues.
Contact with Strangers and Harmful Communities
Hidden messaging apps may contain conversations with unknown contacts, including adults with predatory intentions, communities that encourage eating disorders or self-harm, and secret accounts that host cyberbullying.
As your child or teen removes visibility of their online activities, you as a parent lose an early-warning system to late-night usage spikes, obsessive checking, or mood changes related to specific apps, signs that could help you intervene before a crisis develops.
How to Hide Apps on iPhone
Understanding how apps are hidden will help you know what’s possible and where to look.
Apple’s Hidden Apps Feature in iOS 18
In September 2024, Apple introduced a feature where the app icon and name vanish from the Home Screen entirely, moving into a special Hidden folder in the App Library that requires biometric or passcode authentication to access. These hidden apps won’t appear in Spotlight search, Siri suggestions, or standard app lists. While this feature has legitimate privacy use for adults to protect critical apps such as banking, email, or social media in case their device is lost or stolen, some kids have misused it to make entire categories of apps invisible without any technical workarounds.
Older Tricks Kids Still Use
Before iOS 18, tech-savvy teens found creative workarounds. They could remove apps from the Home Screen to appear only in the App Library, bury them in deep folders, or use the Shortcuts app to change app icons and names, making social apps look like utilities labeled “Tools” or “Notes.”
Calculator and Utility Vault Apps Explained
App stores host dozens of apps that look innocent but serve as secret lockers. Known as vault apps, these masquerade as calculators, music players, or utilities, but hide a private space filled with photos, videos, or messages. Some vault apps require multiple passwords: the first opens a decoy vault with harmless content, while the second unlocks the real stash. Others include stealth features like auto-closing when flipped, photographing wrong-code attempts, or sending fake error messages.
How to Find Hidden Apps on iPhone
Even when apps are hidden from view, they don’t disappear entirely from the device. Knowing where to look can help you get a clearer picture of what’s actually installed on your child’s iPhone.
Check iPhone Storage
To find hidden apps on your teen’s phone, you can start by doing it the old-fashioned way. Go to Settings > General > iPhone Storage. Legitimate calculators or flashlights typically use under 30 MB. A calculator consuming 200 MB or more is likely storing content. Vault apps still report storage usage and usually appear in Screen Time reports unless tracking is disabled. This gives you a concrete detection technique without advanced skills. It’s not foolproof, but it’s a useful starting point.
Review the Hidden Folder in App Library
Open the App Library by swiping left past your last Home Screen page. Scroll all the way down. If any apps are hidden, you’ll see a Hidden section, but accessing it requires authentication. If your teen has set up Face ID, you’ll need their cooperation or their passcode to view this folder.
Analyze Screen Time Reports
Go to Settings > Screen Time > See All Activity, then tap into specific days or weeks and scroll through the Apps section. If your teen uses an app heavily, the total hours will likely appear in usage reports even if the app is hidden from the Home Screen. Keep in mind that users can turn off Screen Time tracking for individual apps, but many teens don’t think to do this, making it a useful secondary check.
Healthy Ways Parents Can Respond to Hidden Apps and Digital Secrecy
Very tech-savvy teens can turn off Screen Time, use web versions of apps in private browsers, or delete vault apps before checks and reinstall them after. Technical detection is a conversation starter, but it won’t address the root cause. The goal isn’t to win in an arms race against your child, but to build an environment where hiding feels less necessary.
Start with Conversations
As a parent, it is natural to check your teen’s phone, even as health organizations urge more dialogue about social media risks. But your teen may worry that you will overreact or judge them harshly for normal experimentation. Resolving this tension requires conversation, not just monitoring.
Frame it as collaborative. Explain your concern about certain apps: cyberbullying, predatory strangers, self-harm content, and scams targeting young people. Ask what they like and dislike about their online spaces and why they feel pressure to hide things. Explain that you’re supporting their safety, not invading privacy. If your teen trusts that distinction, they’re more likely to disclose risky situations.
Set Clear, Age-Appropriate Digital Rules
Create a written family tech agreement that covers specifics: which apps are allowed at which ages, whether vault apps are permitted, the process for joint monthly check-ins rather than surprise raids, and consequences for breaking the rules.
Adjust expectations as kids age: A 13-year-old and a 17-year-old need different levels of autonomy. Younger teens might agree to open-phone policies, while older teens earn more privacy with clear red lines around illegal and harmful content, or contact with unknown adults. When rules are clear and mutually agreed on, teens feel respected and are more likely to follow them.
No locking or hidden apps in Family Sharing: Kids aged 13 to 17 in a Family Sharing group can lock or hide an app. However, a parent or guardian in the group can still see which apps were installed and how much time they were used, and restrict access to them using Screen Time.
Use parental control tools: Consider a comprehensive solution that includes parental controls, which can help your children build healthy digital habits by allowing you to monitor their usage, set limits, and even track their whereabouts.
Recognize the Red Flags
Hidden apps alongside sudden mood changes, withdrawal, secretive behavior, school performance drops, or sleep pattern changes could signal something serious. If you notice these patterns, reach out to school counselors, your child’s pediatrician, or a mental health professional. The goal is early intervention, not punishment. Kids in these situations need help, not sanctions.
Final Thoughts
The ability to hide apps on iPhones has expanded dramatically with iOS 18’s native features and vault apps. While this capability has legitimate privacy use for adults, teens could misuse it by making entire app categories invisible to casual parental checks.
But kids hiding apps are just a symptom, not the root problem. When parents focus solely on finding every hidden app, it can erode trust and push kids to hide even more cleverly. The most effective response blends technical awareness and relationship work.
Have a calm conversation with your child about online privacy and safety. Lead with genuine interest and share concerns openly. Next, collaboratively review the Screen Time and iPhone Storage reports. If you find something unexpected, respond with curiosity, not anger.
Finally, create clear, age-appropriate family agreements about phone use and privacy boundaries. Revisit them as your child grows. Make space for private corners of their digital life while maintaining firm red lines around illegal content, contact with strangers, or harmful material.
Security tools such as McAfee+ Family Plans can support your children’s digital safety by allowing you to block harmful content, manage screen time, and monitor their location. The goal isn’t perfect control. It’s ongoing communication, smart boundaries, and enough visibility to catch warning signs early.
Login
/r/netsec - Information Security News & Discussion
