A trampoline attack is a technique used in sophisticated targeted attacks on iOS devices. In order to prevent the detection of a jailbroken phone, an attacker can alter the behavior of system code, and instead of executing normally, it will instead “jump” to the attacker’s malicious code, while hiding its own existence. This code modification that makes a “jump” to the attacker’s code is known as a “trampoline.”
CrowdStrike Falcon for Mobile iOS app automatically detects and reports the existence of any trampolines in critical system code and marks the device as compromised.