What is com.apple.Webkit.PushBundle... ? Is it Malware or a Virus transferred through iCloud?

Question

Level 1

14 points

What is com.apple.Webkit.PushBundle... ? Is it Malware or a Virus transferred through iCloud?

My daughter is new to her iPhone 12 and some weeks ago was using safari with not as much caution as she should have. She thinks she may have clicked on a link for a website for capcut (from TikTok ) which took her to a a site which she closed then told me about. On investigation I found reports this URL was being used as a spoof website. I think its safe to say she will just have clicked whatever popped up on screen.

The phone was on backup, so to be sure I did a factory reset of her device and reinstalled everything from scratch.

Since then a few quirks have presented themselves (no memories in photos app on her device etc) and after reviewing settings and cross referencing with her sisters phone (iPhone 11) I noticed the the following com.apple.Webkit.PushBundle... and Keyboard Data (Chines & Japanese as toggle options in back up.

Her device is part of the family iCloud account and I'm concerned this could be malware that has impacted all our devices including phones, the family iPad and mac. The same com.apple.Webkit.PushBundle... is on my partners phone.

There is also an entry for Google LLC in storage on her device and the BBC Mundo app listed in the Screentime app that I have never let her download.

After looking at the settings on my two daughters phones I also found that some of her apps (including Apple native apps like Phone, Messages, Wallet and Calculator) are double the size of those on her sisters iPhone 11. The amount given to System files is considerably larger than the iPhone11 despite it being much newer.

All devices are running 16.5.1

My worry is further compounded because on Thursday my phone number was hijacked by scammers to call people from my number. My Sim has been in my possession all the time, and I do not have an eSim.

What should I do?

iPhone 12, iOS 16

Posted on Jul 10, 2023 4:16 AM

Reply

Answer 1

May 14, 2024 4:53 PM in response to LusyW12

SO SORRY, please disregard my recent post about this. I had researched before and didn’t realize I got two different posts mixed up and combined info. This ‘should be’ the correct information… What I have found with regard to com.apple.WebKit.PushBundle…(etc) is that it has to do with an app(primarily a safari link that was ‘added to home screen’ to use as an app) The link does not have an actual app, the icon & description are gone, but the data is present as ‘WebKit PushBundle…’ The toggle stays on unless you turn it off which will delete all the data on iCloud backup, as well as, free up some space on the device.

To reset the phone back to factory settings, as if you just took it out of the box, there’s specific steps that need to be taken. The phone must be signed out of as well as location services needs to be turned off on the device. Then you go through the steps that it tells you to do and you don’t wanna do anything with iCloud at all because all you’re gonna be doing is reinstalling the same apps and data that you’re trying to avoid , you turn off the toggles on the back up and then do a back up. It should remove them from the cloud as well as on the phone. and if all else fails, go to the genius bar at the Apple Store they are more than happy to help you and they’re great with the knowledge that they have hope this helps.

Reply

Answer 2

Jun 6, 2024 7:52 PM in response to Objectivespots

Objectivespots wrote:

Hello, did these responses make sense to you? I have no idea what it means. Is it some computer coder speak that's smarter than me? I'm still don't know if it's malware..

That com.apple.Webkit.PushBundle is how some websites work, and is normal, expected, and benign.

Reply

Answer 3

MrBill3

Level 10

104,416 points

Jul 10, 2023 4:59 AM in response to LusyW12

Hello,

Hmm, iPhones are pretty secure. I would be surprised if any malware was actually installed.

However, I would recommend clearing history etc:

Go to Settings > Safari > Clear History and Website Data. You'll have to log into all accounts again so be sure to know your passwords:

Clear the history and cookies from Safari on your iPhone, iPad, or iPod touch - Apple Support

Note: Just because spammers spoofed the phone number doesn't mean much. I wouldn't worry too much.

Good luck.

Reply

Answer 4

Jul 10, 2023 5:46 PM in response to LusyW12

What persists? com.apple.Webkit.PushBundle? If it didn’t you couldn’t display any websites.

com.apple.Webkit is “behind the scenes” code used by Safari and all other web browsers and apps that access the internet on your iPhone.

Reply

Answer 5

Jul 10, 2023 5:44 PM in response to LusyW12

com.apple.Webkit.PushBundle is an object in the Safari application programming interface. It is invoked any time any website is accessed or updated.

Reply

Answer 6

LusyW12 Author

Level 1

14 points

Jul 10, 2023 5:34 AM in response to MrBill3

Hi MrBill3. Thanks for replying so quickly. I do this regularly on all devices and it still persists.

Reply

Answer 7

Tom Gewecke

Level 10

122,034 points

Jul 10, 2023 6:04 AM in response to LusyW12

Keyboard Data Chinese/Japanese is normal.

Keyboard Data ( Chinese & Japanese ) - Apple Community

Reply

Answer 8

Jan 16, 2024 12:54 PM in response to LusyW12

Still waiting for my data download availability, "appl". Looks like promises aren't being kept but if this isn't really Apple, what does it matter to you?

Reply

Answer 9

Jun 6, 2024 7:44 PM in response to LusyW12

Hello, did these responses make sense to you? I have no idea what it means. Is it some computer coder speak that's smarter than me? I'm still don't know if it's malware..

Reply

What is com.apple.Webkit.PushBundle... ? Is it Malware or a Virus transferred through iCloud?

Similar questions