Just recently, a jailbreak tweak surfaced on Cydia called Lock Saver Free available via ModMyi’s repo that turns off the power consuming features once your iOS device is locked. Surprisingly, the package has been found to contain a trojan that will still remain behind after you remove the tweak from your device.
The trojan hooks into Google’s AdMob banners in order to steal the revenues generated off devices that contain the tweak. Upon installing the package, it copies the trojan files to /Library/MobileSubstrate/
Fortunately, the package has now been removed from ModMyi but if you have already installed it on your device, we recommend that you immediately uninstall it from Cydia. Even after removing the tweak, it will still leave behind two malicious files called ‘Service.dylib’ and ‘Service.plist’. Make sure to remove these files from /Library/MobileSubstrate/
Developer Alan Kerr mentions that the tweak makes /Library/MobileSubstrate/
— Allan Kerr (@Dev_AllanKerr) July 25, 2015
I’m surprised that the tweak managed to slip through ModMyi’s package review process before becoming available to Cydia users. If you have already installed it, head to Cydia now and remove the package as well as the two malicious files found in /Library/MobileSubstrate/