In April, Apple sent notifications to iPhone users in 92 countries, warning them they’d been targeted with spyware. “Apple detected that you are being targeted by a mercenary spyware attack that is trying to remotely compromise the iPhone associated with your Apple ID,” the notification reads.
Users quickly took to social media sites including X, trying to work out what the notification meant. Many of those targeted were based in India, but others in Europe also reported receiving Apple’s warning.
Weeks later, little is still known about the latest iPhone attacks, but former smartphone giant Blackberry has released research indicating they are linked to a Chinese spyware campaign dubbed “LightSpy.”
Described as a “sophisticated iOS implant,” LightSpy first emerged targeting Hong Kong protesters in 2020. However, the latest iteration is much more capable than the first.
“It is a fully-featured modular surveillance toolset that primarily focuses on exfiltrating victims’ private information, including hyper-specific location data and sound recording during voice over IP calls,” the researchers wrote.
It’s not the first time Apple has issued notifications of this kind. The iPhone maker has sent out alerts to people in over 150 countries since 2021 as spyware continues to target high-profile figures across the globe. Apple did not respond to a request for comment.
Spyware can be weaponized by nation-state adversaries. Its deployment is typically highly targeted against a very specific group of people, including journalists, political dissidents, government workers, and businesses in certain sectors, but it is extremely dangerous.
Zero-Click Attacks
Spyware gives attackers access to the smartphone’s mic and allows them to view everything you write, including messages on encrypted apps such as WhatsApp and Signal. They can also track your location, collect passwords, and harvest information from apps.
In the past, spyware was delivered via phishing, requiring the victim to click on a link or download an image. Today, it can be delivered in so-called “zero-click attacks” via an iMessage or WhatsApp image that will automatically plant spyware on your device.
In 2021, researchers at Google’s Project Zero detailed how an iMessage-based zero-click exploit was used to target a Saudi activist. “Short of not using a device, there is no way to prevent exploitation by a zero-click exploit; it’s a weapon against which there is no defense,” the researchers warned.
The spyware infection chain using zero-click exploits via iMessage was demonstrated by security outfit Kaspersky as part of its Operation Triangulation research last year.
All that needs to happen is, the victim receives an iMessage with an attachment containing a zero-click exploit. “Without any further interaction, the message triggers a vulnerability, leading to code execution for privilege escalation and providing full control over the infected device,” says Boris Larin, principal security researcher at Kaspersky’s Global Research & Analysis Team.
Once the attacker establishes their presence on the device, he says, the message is automatically deleted.
Rise of Pegasus
The most prominent and well-known spyware is Pegasus, made by Israeli firm NSO Group to target vulnerabilities in iOS and Android software.
Spyware only exists because of vendors such as NSO Group, which claims it sells exploits to governments only to hunt criminals and terrorists. “Any customers, including governments in Europe and North America, agree not to disclose those vulnerabilities,” says Richard Werner, cybersecurity advisor at Trend Micro.
