www.bleepingcomputer.com
Open in
urlscan Pro
104.20.59.209
Public Scan
URL:
https://www.bleepingcomputer.com/news/security/newly-found-zero-click-iphone-exploit-used-in-nso-spyware-attacks/
Submission: On April 20 via api from AU — Scanned from DE
Submission: On April 20 via api from AU — Scanned from DE
Form analysis 6 forms found in the DOM
https://www.bleepingcomputer.com/search/
<form title="Search site" action="https://www.bleepingcomputer.com/search/">
<input type="hidden" name="cx" value="partner-pub-0920899300397823:3529943228">
<input type="hidden" name="cof" value="FORID:10">
<input type="hidden" name="ie" value="UTF-8">
<input type="search" name="q" aria-label="Search Site" placeholder="Search Site">
</form>https://www.bleepingcomputer.com/search/
<form action="https://www.bleepingcomputer.com/search/">
<input type="hidden" name="cx" value="partner-pub-0920899300397823:3529943228">
<input type="hidden" name="cof" value="FORID:10">
<input type="hidden" name="ie" value="UTF-8">
<input type="search" name="q" aria-label="Search Site" placeholder="Search Site">
</form>POST //bleepingcomputer.us10.list-manage.com/subscribe/post?u=3e2b3b692f780cdff40d45346&id=30c98e654e
<form action="//bleepingcomputer.us10.list-manage.com/subscribe/post?u=3e2b3b692f780cdff40d45346&id=30c98e654e" method="post" target="_blank" novalidate="">
<input type="email" name="EMAIL" aria-label="Enter email address" placeholder="Email Address...">
<div style="position: absolute; left: -5000px;"><input type="hidden" aria-hidden="true" name="b_3e2b3b692f780cdff40d45346_30c98e654e" tabindex="-1" value=""></div>
<input type="submit" value="Submit" class="bc_sub_btn">
</form>POST //bleepingcomputer.us10.list-manage.com/subscribe/post?u=3e2b3b692f780cdff40d45346&id=30c98e654e
<form action="//bleepingcomputer.us10.list-manage.com/subscribe/post?u=3e2b3b692f780cdff40d45346&id=30c98e654e" method="post" target="_blank" novalidate="">
<input type="email" aria-label="Enter email address" name="EMAIL" placeholder="Email Address...">
<div style="position: absolute; left: -5000px;"><input type="hidden" aria-hidden="true" name="b_3e2b3b692f780cdff40d45346_30c98e654e" tabindex="-1" value=""></div>
<input type="submit" value="Submit" class="bc_sub_btn">
</form>POST https://www.bleepingcomputer.com/forums/index.php?app=core&module=global§ion=login&do=process&return=https://www.bleepingcomputer.com/news/security/newly-found-zero-click-iphone-exploit-used-in-nso-spyware-attacks/
<form action="https://www.bleepingcomputer.com/forums/index.php?app=core&module=global&section=login&do=process&return=https://www.bleepingcomputer.com/news/security/newly-found-zero-click-iphone-exploit-used-in-nso-spyware-attacks/"
method="post">
<div class="bc_form_feild">
<label for="ips_username">Username</label>
<input aria-label="Enter login name" title="Enter login name" type="text" id="ips_username" name="ips_username" autocomplete="username">
</div>
<div class="bc_form_feild">
<label for="ips_password">Password</label>
<input aria-label="Enter login password" title="Enter login passwod" type="password" id="ips_password" name="ips_password" autocomplete="current-password">
</div>
<div class="bc_form_feild">
<div class="bc_remember">
<input id="remember" type="checkbox" name="rememberMe" value="1" checked="checked">
<label for="remember">Remember Me</label>
</div>
<div class="bc_anon">
<input id="anonymous" type="checkbox" name="anonymous" value="1">
<label for="anonymous">Sign in anonymously</label>
</div>
</div>
<div class="bc_btn_wrap">
<input type="hidden" name="auth_key" value="880ea6a14ea49e853634fbdc5015a024">
<input type="submit" aria-label="Login to site" title="Login" value="Login" class="bc_sub_btn">
<a aria-label="Sign in with Twitter" href="https://www.bleepingcomputer.com/forums/index.php?app=core&module=global&section=login&serviceClick=twitter&return=https://www.bleepingcomputer.com/news/security/newly-found-zero-click-iphone-exploit-used-in-nso-spyware-attacks/" class="bc_twitter_btn"><img src="https://www.bleepstatic.com/images/site/login/twitter.png" width="28" height="24" alt="Sign in with Twitter button"> Sign in with Twitter</a>
<hr>
<p>Not a member yet? <a aria-label="Register account" title="Register account" href="https://www.bleepingcomputer.com/forums/index.php?app=core&module=global&section=register">Register Now</a></p>
</div>
</form><form>
<input type="hidden" id="comment-id-report" value="0">
<ul>
<li>
<label><input type="radio" name="comment-report-reason" value="Spam">Spam</label>
</li>
<li>
<label><input type="radio" name="comment-report-reason" value="Abusive or Harmful">Abusive or Harmful</label>
</li>
<li>
<label><input type="radio" name="comment-report-reason" value="Inappropriate content">Inappropriate content</label>
</li>
<li>
<label><input type="radio" name="comment-report-reason" value="Strong language">Strong language</label>
</li>
<li>
<label><input type="radio" name="comment-report-reason" value="Other">Other</label>
</li>
<li id="comment-report-other-reason-wrap" style="display:none;">
<textarea aria-label="Enter other reason for reporting the comment" rows="2" cols="2" id="comment-report-other-reason"></textarea>
</li>
</ul>
<p>Read our <a href="https://www.bleepingcomputer.com/posting-guidelines/">posting guidelinese</a> to learn what content is prohibited.</p>
</form>Text Content
WE VALUE YOUR PRIVACY
We and our partners store and/or access information on a device, such as cookies
and process personal data, such as unique identifiers and standard information
sent by a device for personalised ads and content, ad and content measurement,
and audience insights, as well as to develop and improve products.
With your permission we and our partners may use precise geolocation data and
identification through device scanning. You may click to consent to our and our
partners’ processing as described above. Alternatively you may access more
detailed information and change your preferences before consenting or to refuse
consenting. Please note that some processing of your personal data may not
require your consent, but you have a right to object to such processing. Your
preferences will apply to this website only. You can change your preferences at
any time by returning to this site or visit our privacy policy.
MORE OPTIONSAGREE
*
*
*
*
*
*
* News
* Featured
* Latest
* US warns of Lazarus hackers using malicious cryptocurrency apps
* Hackers steal $655K after picking MetaMask seed from iCloud backup
* Newly found zero-click iPhone exploit used in NSO spyware attacks
* Windows 10 21H2 now in broad deployment, available to everyone
* CISA warns of attackers now exploiting Windows Print Spooler bug
* Emotet botnet switches to 64-bit modules, increases activity
* QNAP urges customers to disable UPnP port forwarding on routers
* Microsoft disables SMB1 by default for Windows 11 Home Insiders
* Downloads
* Latest
* Most Downloaded
* Qualys BrowserCheck
* STOPDecrypter
* AuroraDecrypter
* FilesLockerDecrypter
* AdwCleaner
* ComboFix
* RKill
* Junkware Removal Tool
* Virus Removal Guides
* Latest
* Most Viewed
* Ransomware
* How to remove the PBlock+ adware browser extension
* Remove the Toksearches.xyz Search Redirect
* Remove the Smashapps.net Search Redirect
* Remove the Smashappsearch.com Search Redirect
* Remove Security Tool and SecurityTool (Uninstall Guide)
* How to remove Antivirus 2009 (Uninstall Instructions)
* How to Remove WinFixer / Virtumonde / Msevents / Trojan.vundo
* How to remove Google Redirects or the TDSS, TDL3, or Alureon rootkit using
TDSSKiller
* Locky Ransomware Information, Help Guide, and FAQ
* CryptoLocker Ransomware Information Guide and FAQ
* CryptorBit and HowDecrypt Information Guide and FAQ
* CryptoDefense and How_Decrypt Ransomware Information Guide and FAQ
* Tutorials
* Latest
* Popular
* How to make the Start menu full screen in Windows 10
* How to install the Microsoft Visual C++ 2015 Runtime
* How to open an elevated PowerShell Admin prompt in Windows 10
* How to Translate a Web Page in Google Chrome
* How to start Windows in Safe Mode
* How to remove a Trojan, Virus, Worm, or other Malware
* How to show hidden files in Windows 7
* How to see hidden files in Windows
* Deals
* Categories
* eLearning
* IT Certification Courses
* Gear + Gadgets
* Security
* Forums
* More
* Startup Database
* Uninstall Database
* File Database
* Glossary
* Chat on Discord
* Send us a Tip!
* Welcome Guide
* Home
* News
* Security
* Newly found zero-click iPhone exploit used in NSO spyware attacks
* AddThis Sharing Buttons
Share to FacebookFacebookShare to TwitterTwitterShare to
LinkedInLinkedInShare to RedditReddit329Share to Hacker NewsHacker NewsShare
to EmailEmail
*
NEWLY FOUND ZERO-CLICK IPHONE EXPLOIT USED IN NSO SPYWARE ATTACKS
By
SERGIU GATLAN
* April 18, 2022
* 02:42 PM
* 0
Digital threat researchers at Citizen Lab have discovered a new zero-click
iMessage exploit used to install NSO Group spyware on iPhones belonging to
Catalan politicians, journalists, and activists.
The previously unknown iOS zero-click security flaw dubbed HOMAGE affects some
versions before iOS 13.2 (the latest stable iOS version is 15.4).
It was used in a campaign targeting at least 65 people with NSO's Pegasus
spyware between 2017 and 2020, together with the Kismet iMessage exploit and a
WhatsApp flaw.
PLAY Top Articles Video Settings Full Screen About Connatix V159343 Read More
Read More Read More Read More Read More Read More CISA warns of attackers now
exploitingWindows Print Spooler bug 1/1 Skip Ad Continue watching after the ad
Visit Advertiser websiteGO TO PAGE
Among the victims of these attacks, Citizen Lab mentioned Catalan Members of the
European Parliament (MEPs), every Catalan president since 2010, as well as
Catalan legislators, jurists, journalists, and members of civil society
organizations and their families.
"Among Catalan targets, we did not see any instances of the HOMAGE exploit used
against a device running a version of iOS greater than 13.1.3. It is possible
that the exploit was fixed in iOS 13.2," Citizen Lab said.
"We are not aware of any zero-day, zero-click exploits deployed against Catalan
targets following iOS 13.1.3 and before iOS 13.5.1."
The academic research lab has reported and provided Apple with the forensic
artifacts needed to investigate the exploit and says there is no evidence that
Apple customers using the latest versions of iOS are exposed to HOMAGE attacks.
"At this time the Citizen Lab is not conclusively attributing these hacking
operations to a particular government, however a range of circumstantial
evidence points to a strong nexus with one or more entities within Spanish
government," Citizen Lab added.
EU COMMISSION, UK GOVT, FINNISH DIPLOMATS, US STATE DEPT ALSO TARGETED
As Reuters reported, NSO spyware was also used in attacks targeting senior
European Commission officials last year, including the European Justice
Commissioner.
According to Citizen Lab Director Ron Deibert, multiple suspected infections
with Pegasus spyware within official UK networks were also reported by Citizen
Lab to the government of the United Kingdom.
A suspected infection on a device belonging to an official at the Prime
Minister's Office was associated with Pegasus operators linked to the UAE, while
attacks relating to UK's Foreign and Commonwealth Office linked to the UAE,
India, Cyprus, and Jordan.
Finland's Ministry for Foreign Affairs said in January that devices of Finnish
diplomats had been infected with NSO Group's Pegasus spyware after US Department
of State employees also found that their iPhones had been hacked to install the
same spyware.
The European Parliament is setting up a committee of inquiry (which will hold
its first meeting on April 19) to investigate breaches of EU law stemming from
the use of NSO Pegasus and equivalent spyware.
Pegasus, a spyware tool developed by Israeli surveillance firm NSO Group, is
marketed as surveillance software licensed to governments worldwide for
"investigating crime and terror."
"The spyware covertly penetrates mobile phones (and other devices) and is
capable of reading texts, listening to calls, collecting passwords, tracking
locations, accessing the target device's microphone and camera, and harvesting
information from apps," Citizen Labs explains.
"Encrypted calls and chats can also be monitored. The technology can even
maintain access to victims' cloud accounts after the infection has ended."
RELATED ARTICLES:
Apple emergency update fixes zero-days used to hack iPhones, Macs
2021 mobile security: Android more vulnerabilities, iOS more zero-days
Hackers steal $655K after picking MetaMask seed from iCloud backup
Critical Windows RPC CVE-2022-26809 flaw raises concerns — Patch now
Hackers exploit critical VMware CVE-2022-22954 bug, patch now
* Apple
* Exploit
* iOS
* iPhone
* NSO Group
* Pegasus Spyware
* Spyware
* Facebook
* Twitter
* LinkedIn
* Email
*
SERGIU GATLAN
Sergiu Gatlan is a reporter who covered cybersecurity, technology, Apple,
Google, and a few other topics at Softpedia for more than a decade. Email or
Twitter DMs for tips.
* Previous Article
* Next Article
POST A COMMENT COMMUNITY RULES
YOU NEED TO LOGIN IN ORDER TO POST A COMMENT
Not a member yet? Register Now
YOU MAY ALSO LIKE:
Popular Stories
* Unofficial Windows 11 upgrade installs info-stealing malware
* Customize your Windows 11 experience with these apps
NEWSLETTER SIGN UP
To receive periodic updates and news from BleepingComputer, please use the form
below.
NEWSLETTER SIGN UP
* Follow us:
*
*
*
*
MAIN SECTIONS
* News
* Downloads
* Virus Removal Guides
* Tutorials
* Startup Database
* Uninstall Database
* File Database
* Glossary
COMMUNITY
* Forums
* Forum Rules
* Chat
USEFUL RESOURCES
* Welcome Guide
* Sitemap
COMPANY
* About BleepingComputer
* Contact Us
* Send us a Tip!
* Advertising
* Write for BleepingComputer
* Social & Feeds
* Changelog
Terms of Use - Privacy Policy - Ethics Statement
Copyright @ 2003 - 2022 Bleeping Computer® LLC - All Rights Reserved
LOGIN
Username
Password
Remember Me
Sign in anonymously
Sign in with Twitter
--------------------------------------------------------------------------------
Not a member yet? Register Now
REPORTER
HELP US UNDERSTAND THE PROBLEM. WHAT IS GOING ON WITH THIS COMMENT?
* Spam
* Abusive or Harmful
* Inappropriate content
* Strong language
* Other
*
Read our posting guidelinese to learn what content is prohibited.
Submitting...
SUBMIT