MeridianMeridian

iMazing 3.6.3 Restores Sideloading of Removed iOS Apps via macOS After Apple Authentication Changes

Developers of iMazing have released version 3.6.3 that restores the ability for users to download and install applications previously removed from the App Store onto iPhone devices. The update currently functions only through macOS, with Windows support still pending further development. The changes address authentication and download errors that appeared in macOS 26 and earlier versions following modifications by Apple to its CommerceKit system. Apple began returning HTTP 403 Forbidden responses to tools including iMazing, ipa_downloader, and 3uTools by deactivating legacy tokens and revoking certificates used for app authentication. The restrictions have particularly affected Russian users who relied on these tools to reinstall banking and other applications removed due to sanctions. Support for macOS 27 Golden Gate and Windows remains unavailable and requires additional engineering work.

AntiMalwareTranslated from Russian

Read at source

Developers of iMazing have released version 3.6.3 that restores the ability for home users to sideload applications previously removed from the App Store onto iPhone devices. The update works exclusively through macOS at present, while Windows users must wait for further fixes.

The release resolves authentication and download errors affecting macOS 26 and earlier versions. After applying the patch, developers strongly recommend rebooting the computer. Support for macOS 27 Golden Gate and Windows has not yet been restored because these platforms require additional development work.

The problems originated after Apple modified its backend systems. Tools such as iMazing, ipa_downloader, 3uTools, and others stopped receiving installation files from the App Store media library, with servers returning HTTP 403 Forbidden errors. According to participants in the ipatool project, Apple began rejecting both new and legacy authentication methods in CommerceKit, deactivated old tokens, and revoked certain certificates.

Even previously saved IPA files often proved insufficient because transferring an application to another device still required a valid digital signature. The restrictions have hit Russian users especially hard, as they used iMazing to recover banking and other applications removed from the App Store following sanctions.

AppleiMazingCommerceKit3uToolsipatool
ShareXFacebookLinkedInReddit
Meridian digestThe week's most consequential security stories, distilled into one briefing.See the digest

More in Policy & Regulation

Russian Minister Proposes Blocking All SIM Cards Linked to Fraudsters Banned in MAX Messenger
Policy & Regulation

Russian Minister Proposes Blocking All SIM Cards Linked to Fraudsters Banned in MAX Messenger

The head of Russia's Ministry of Digital Development, Maksut Shadaev, has suggested extending account bans in the MAX messenger to a broader set of mobile restrictions. Under the proposal, operators would be required to disconnect not only the number used in a fraudulent account but also any other SIM cards belonging to the same individual. The measure would also introduce a cooling-off period preventing the person from registering new numbers after a ban. Officials aim to make it significantly harder for scammers to resume operations following enforcement actions. Key implementation details, including how ownership and involvement in fraud will be verified, remain unspecified in the initial statement. The initiative specifically targets fraud prevention and does not apply to every account suspension in the messenger.

AntiMalwareOct 29, 2026Translated from Russian

Russia Ready to Disclose Source Code of Social Networks, Messengers and AI Models
Policy & Regulation

Russia Ready to Disclose Source Code of Social Networks, Messengers and AI Models

Russian Minister of Digital Development Maksut Shadaev announced that the country is prepared to open the source code of its domestic social networks, messengers, and video services to international partners. Shadaev stated that Russia will show the internal structure of these platforms and allow joint modification of algorithms. The proposal was presented at the Platform of Sovereign Development exhibition and reported by TASS. He contrasted Western IT products, described as opaque black boxes, with Russia's new approach of transparency to avoid what he called digital colonialism. The same offer extends to Russian foundational AI models, which could be adapted to foreign legislation, cultural requirements, and security standards. No specific products, repository links, timelines, or licensing terms were provided during the speech.

AntiMalwareOct 29, 2026Translated from Russian

Russia Mulls Mandatory Two-Week IMEI Registration for Foreign Smartphones via Gosuslugi
Policy & Regulation

Russia Mulls Mandatory Two-Week IMEI Registration for Foreign Smartphones via Gosuslugi

Russian authorities are discussing a new rule requiring owners of smartphones imported without customs clearance or purchased abroad to register the devices through the Gosuslugi portal within two weeks. Failure to register would result in the device being blocked from Russian mobile networks. The Ministry of Digital Development is preparing the requirements, which remain under discussion with possible changes to timelines and details. Devices already operating in Russia before April 2027 would be exempt and continue working without restrictions. Officially imported equipment would be added to the registry automatically. The measure is expected to significantly impact gray-market sellers, potentially forcing up to 70 percent of them out of the market and driving price increases of up to 40 percent for some models.

AntiMalwareOct 29, 2026Translated from Russian