Report: Pegasus Spyware Sold to Governments Uses Zero-Click iMessage Exploit to Infect iPhones Running iOS 14.6

Journalists, lawyers, and human rights activists around the world have been targeted by authoritarian governments using phone malware made by Israeli surveillance firm NSO Group, according to multiple media reports.

nso israeli surveillance firm
An investigation by 17 media organizations and Amnesty International's Security Lab uncovered a massive data leak, indicating widespread and continuing abuse of the commercial hacking spyware, Pegasus, which can infect iPhones and Android devices and enable attackers to extract messages, emails, and media, and record calls and secretly activate microphones.

The leak contains a list of over 50,000 phone numbers that are believed to have been identified by clients of NSO as possible people of interest. Forbidden Stories, a Paris-based nonprofit media organization, and Amnesty International had access to the leaked list and shared that access with media partners as part of reporting consortium the Pegasus project. Forensic tests on some of the phones with numbers on the list indicated that more than half had traces of the spyware.

The company behind the software, NSO, denies any wrongdoing and claims its product is strictly for use against criminals and terrorists, and is made available only to military, law enforcement and intelligence agencies.

In a statement given to media organizations in response to the Pegasus project, NSO said the original investigation which led to the reports was "full of wrong assumptions and uncorroborated theories."

NSO does not operate the systems that it sells to vetted government customers, and does not have access to the data of its customers' targets. NSO does not operate its technology, does not collect, nor possesses, nor has any access to any kind of data of its customers. Due to contractual and national security considerations, NSO cannot confirm or deny the identity of our government customers, as well as identity of customers of which we have shut down systems.

In an earlier version of the spyware, surveillance activity depended on the phone user clicking on a malicious link sent to them in a text or email (so-called "spear-phishing"). However, the most recently discovered version doesn't require interaction from the user and can instead exploit "zero-click" vulnerabilities – bugs or flaws in the OS – to succeed.

For example, Amnesty's Security Lab and Citizen Lab found an iPhone running iOS 14.6 could be hacked with a zero-click iMessage exploit to install Pegasus.


Meanwhile, media organizations involved in the project plan to reveal the identities of people whose number appeared on the list in the coming days. They are said to include hundreds of business executives, religious figures, academics, NGO employees, union officials and government officials. Disclosures which began on Sunday have already revealed that the numbers of more than 180 journalists are already known to be among the data.

WhatsApp sued NSO in 2019 after it alleged the company was behind cyber-attacks on thousands of mobile phones involving Pegasus. NSO denied any criminal wrongdoing, but the company has been banned from using WhatsApp.

Update: Apple has provided the following statement condemning the use of the zero-click exploit against journalists, lawyers, and human rights activists to The Guardian.

In a statement, the iPhone maker said: “Apple unequivocally condemns cyber-attacks against journalists, human rights activists, and others seeking to make the world a better place. For over a decade, Apple has led the industry in security innovation and, as a result, security researchers agree iPhone is the safest, most secure consumer mobile device on the market.”

Apple also said that security was a dynamic field and that its BlastDoor was not the end of its efforts to secure iMessage.

“Attacks like the ones described are highly sophisticated, cost millions of dollars to develop, often have a short shelf life, and are used to target specific individuals,” it said. “While that means they are not a threat to the overwhelming majority of our users, we continue to work tirelessly to defend all our customers, and we are constantly adding new protections for their devices and data.”

Note: Due to the political or social nature of the discussion regarding this topic, the discussion thread is located in our Political News forum. All forum members and site visitors are welcome to read and follow the thread, but posting is limited to forum members with at least 100 posts.

Top Rated Comments

mdnz Avatar
16 months ago

iOS 14.7 is around the corner and will be released this week. I don't think Apple has to worry about it.

Android can't say much on their behalf.
Just upping a version number doesn't mean the problem is fixed.
Score: 53 Votes (Like | Disagree)
One2Grift Avatar
16 months ago

I don't like blaming people but in this case, it's all on apple

- They DO actually have infinite resources with 200Bn USD in the bank

- They continually prioritize features some marketing monkeys thought up - iMessage, targeted here, is the best example. Apple has really good engineers working there, I am 100% sure some of them spoke up and sad "guys, this is a bad idea there's no way to make an app API, tons of animation features, customizable emojis, customizable animations, free floating sticky notes, all secure in one big release. We need to hold off on this. but they were outvoted by the marketing monkeys ("this will sell more iphones")

- Their software process is antiquated and wasn't good when it was first invented sometime in the 80ies. That's why Avi left.
They don’t have infinite resources, that’s just a bizarre statement.

Software vulnerabilities happen, it is a fact of life. Yes, A company must patch them ASAP. Apple has been excellent at keeping vulnerabilities to an extreme minimum and patching them quickly. But if they knew about this one sooner and didn’t patch it, then there is a problem

Since both Microsoft and Google have infinite resources based upon your bizarre math,you must be furious at them given malware numbers for them.
Score: 18 Votes (Like | Disagree)
Packers1958 Avatar
16 months ago
Don’t worry. Apple is on top of it. They are planning to offer a new line of $150 apple watch bands this week.
Score: 15 Votes (Like | Disagree)
jasonefmonk Avatar
16 months ago
This is pretty serious by the description. Holy ****.
Score: 15 Votes (Like | Disagree)
contacos Avatar
16 months ago

iOS 14.7 is around the corner and will be released this week. I don't think Apple has to worry about it.

Android can't say much on their behalf.
What does that have to do with any of it? Changing the build number is not going to magically fix this exploit
Score: 14 Votes (Like | Disagree)
orthorim Avatar
16 months ago
Apple's only got itself to blame.

iMessage was a festering cesspit of vulnerability since they added all this nonsense, emojos, apps (!!!) - well adding apps and an app API to your messsaging is a guaranteed way to open it up to all sorts of vulnerabilities

apple has massive problems that are built into iOS and Mac OS, that are are non-fixable:

- Video player with thousands of features and a multiple decades old codebase - this is going to have enough zero days for the next 100 years

- iMessages, wantonly compromised by features nobody is using, since they're all walled garden features relying on network effects, therefore all doomed to fail. There was no reason to do this. Just show the text. Add images. Done.

- FaceTime - likely has endless vulnerabilities as well, like QuickTime

And many others - there's so much stuff they're building that's a security disaster from the get go.

I have followed the "security related updates" for the past few iPhone updates, and it's pretty shocking, yet not surprising, as each one of these point updates fixes 10, 20, or even 30 zero day exploits.

millions left to go.
Score: 12 Votes (Like | Disagree)

Related Stories

powerdir exploit microsoft

Microsoft Discovered New 'Powerdir' macOS Vulnerability, Fixed in 12.1 Update

Monday January 10, 2022 9:17 am PST by
Microsoft's 365 Defender Research Team this morning published details on a new "Powerdir" macOS vulnerability that let an attacker bypass the Transparency, Consent, and Control technology to gain unauthorized access to protected data. Apple already addressed the CVE-2021-30970 vulnerability in the macOS Monterey 12.1 update that was released in December, so users who have updated to the...
General Apps Messages

Apple's iMessage Service Experiencing Issues [Update: Resolved]

Thursday March 24, 2022 1:49 pm PDT by
If you're currently having trouble sending iMessages to friends and family, you're not alone. Apple's iMessage service appears to be experiencing some kind of outage that is preventing messages from being delivered. There are multiple complaints about the iMessage outage on Twitter, and MacRumors can confirm that we too are experiencing problems in our Messages testing. In some cases,...
apple security banner

Apple Outlines How It Will Notify Users Who Have Been Targeted by State-Sponsored Spyware Attacks

Tuesday November 23, 2021 8:15 pm PST by
Earlier today, Apple announced that it had filed suit against NSO Group, the firm responsible for the Pegasus spyware that has been used in state-sponsored surveillance campaigns in a number of countries. NSO Group seeks to take advantage of vulnerabilities in iOS and other platforms to infiltrate the devices of targeted users such as journalists, activists, dissidents, academics, and government...
iOS App Store General Feature JoeBlue

U.S. Bills Allowing Sideloading Would Cause Consumers to Be Hit With 'Malware, Ransomware, and Scams,' Says Apple

Tuesday January 18, 2022 11:42 am PST by
U.S. bills that would require major changes to the App Store would ultimately cause consumers to be targeted with malware, ransomware, and scams, Apple's Senior Director of Government Affairs Timothy Powderly said in a letter that was sent today to the Senate Judiciary Committee and that was obtained by MacRumors. Apple sent the letter as the Judiciary Committee prepares to consider the Amer...
iOS App Store General Feature JoeBlue

U.S. Senate Judiciary Committee Approves Another Antitrust Bill That Would Allow Sideloading on iPhone

Thursday February 3, 2022 8:32 am PST by
The U.S. Senate Judiciary Committee today approved the bipartisan Open App Markets Act, an antitrust bill that would allow for alternative app stores and alternative in-app payment systems on the iPhone. The bill will now head to the Senate floor for a vote. Apple had urged the U.S. Senate Judiciary Committee to reject the bill, arguing that sideloading would pose privacy and security risks...
14 16 inch 2021 mbps back to back feature

Hackers Behind MacBook Pro Schematics Leak Arrested in Russia

Friday January 14, 2022 7:23 am PST by
The ransomware hackers behind last year's MacBook Pro schematics leak have now been arrested in Russia, the FSB today announced in a press release (via Reuters). Following an initial arrest late last year, Russia's Federal Security Service (FSB) explained that it has arrested 14 members of "REvil," an organized criminal association that used malicious software to extort funds from companies. ...
tmobilelogo

T-Mobile's Latest Data Breach Linked to SIM Swap Attacks

Wednesday December 29, 2021 10:15 am PST by
Back in August, T-Mobile suffered a massive data breach impacting more than 50 million current, former, and prospective T-Mobile users, and now the cellular company is dealing with another smaller data breach incident. Reports yesterday suggested that T-Mobile was aware of unauthorized activity affecting some customer accounts, and now, T-Mobile has confirmed that those reports were due to...
iOS App Store General Feature JoeBlue

Upcoming EU Sideloading Bill Would 'Cripple the Privacy and Security Protections' iPhone Users Expect, Says Apple

Thursday March 17, 2022 10:38 am PDT by
The European Union is set to introduce new legislation as soon as this month that would significantly affect how the App Store operates in Europe, reports The Wall Street Journal. The Digital Markets Act has been in development for some time and the finalized version that could be completed as soon as this month will allow for sideloading and alternate app store options. Apple will be...

Popular Stories

apple watch ultra hammer test

YouTuber Tests Apple Watch Ultra Durability With a Hammer: Table Breaks Before the Watch

Sunday September 25, 2022 2:27 pm PDT by
A YouTuber has put Apple's claims for the durability of the Apple Watch Ultra to the test by putting it up against a drop test, a jar of nails, and repeated hits with a hammer to test the sapphire crystal protecting the display. TechRax, a channel popular for testing the durability of products, first tested the Apple Watch Ultra by dropping it from around four feet high. The Apple Watch...
tim cook spring loaded event

Six Major Products to Expect From Apple in 2023

Sunday September 25, 2022 10:57 am PDT by
As we approach the end of a busy product release season for Apple with only new iPads and Macs left to be announced over the next month or so, we're also setting our sights on 2023. Apple is rumored to have several major products in the pipeline for next year, including new Macs, a new HomePod, a VR/AR headset, and so much more. Other than new iPhones and Apple Watches, which are expected...
Tim Cook Apple Event

Gurman: New iPads and Macs May Be Announced Through Press Releases, No October Event

Sunday September 25, 2022 6:50 am PDT by
Apple may decide to release its remaining products for 2022, which include updated iPad Pro, Mac mini, and 14-inch and 16-inch MacBook Pro models, through press releases on its website rather than a digital event, according to Bloomberg's Mark Gurman. In his latest Power On newsletter, Gurman said that Apple is currently "likely to release its remaining 2022 products via press releases,...
AirPods Max 2022 Colors

Ten Things AirPods Pro 2 Tell Us About AirPods Max 2

Saturday September 24, 2022 1:00 am PDT by
Upon the release of the second-generation AirPods Pro, the AirPods Max became the oldest current-generation AirPods product still in Apple's lineup. Introducing several new features like Adaptive Transparency and the H2 chip, the second-generation AirPods Pro may provide some of the best indications yet of what to expect from the second-generation AirPods Max. Almost two years later, rumors...
iPhone 14 Pro Sports Scores Dynamic Island

iPhone 14 Pro Features Live Sports Scores in Dynamic Island on iOS 16.1

Monday September 26, 2022 7:52 am PDT by
Earlier this month, Apple announced that iOS 16.1 will enable a new Live Activities feature that allows iPhone users to stay on top of things that are happening in real time, such as a sports game or a food delivery order, right from the Lock Screen. On the iPhone 14 Pro and Pro Max, Live Activities also integrate with the Dynamic Island. Premier League match in Dynamic Island via Paul Bradford ...
General iOS 16 Feature Yellow

Some iOS 16 Users Continue to Face Unaddressed Bugs and Battery Drain Two Weeks After Launch

Monday September 26, 2022 7:34 am PDT by
Today marks exactly two weeks since Apple released iOS 16 to the public. Besides the personalized Lock Screen, major changes in Messages, and new features in Maps, the update has also seen its fair share of bugs, performance problems, battery drain, and more. After major iOS updates, it's normal for some users to report having issues with the new update, but such reports usually subside in...
iPhone 14 Pros in Hand Black Background Feature

Verizon iPhone 14 Pro Customers Reporting Cellular Connection Issues

Monday September 26, 2022 6:23 am PDT by
iPhone 14 Pro customers on the Verizon network in the U.S. are reporting issues with slow and unreliable 5G cellular connections and calls randomly dropping. Several threads on Reddit (1,2,3) and the MacRumors forums chronicle issues faced by Verizon customers and Apple's latest iPhone. According to user reports, signal strength on the iPhone 14 Pro is unreliable and weak, while other...
iphone 14 pro max deep purple

iPhone 15 'Ultra' Could Replace Pro Max Model Next Year

Sunday September 25, 2022 7:02 am PDT by
Apple is gearing up to possibly replace its "Pro Max" iPhone with an all-new "Ultra" iPhone 15 model next year, reliable Bloomberg journalist Mark Gurman said today. Writing in his latest Power On newsletter, Gurman said that for the iPhone 15, Apple is planning a revamped design alongside USB-C and a potential name change. Apple could replace its "Pro Max" branding, which it started to use...
apple watch ultra deuglify 1

Apple Watch Ultra User Mods Titanium Casing to 'Deuglify' Design

Tuesday September 27, 2022 8:05 am PDT by
An Apple Watch Ultra user has modified their new device's casing to add a brushed finish and remove the orange color of the Action Button in an effort to make it more visually appealing. The Apple Watch Ultra offers the first complete redesign of the Apple Watch since the product line's announcement in 2014, and while the design has been met with praise from many users, some have criticized...