Thursday , March 13 2025

iPhones Hacked Via iOS Zero-Click Exploit To Deploy Spyware

Microsoft Threat Intelligence experts say a threat group is associated with “QuaDream,” an Israeli-based private sector offensive actor (PSOA).

It employed a zero-click exploit called END OF DAYS to compromise the iPhones of high-risk individuals.

CVE-2025-25291 & CVE-2025-25292
Attention! GitLab Patched Critical Authentication Bypass Flaws

GitLab has released versions 17.9.2, 17.8.5, and 17.7.7 for its Community and Enterprise Editions to fix security vulnerabilities, including a...
Read More
CVE-2025-25291 & CVE-2025-25292  Attention! GitLab Patched Critical Authentication Bypass Flaws

CVE-2025-20138
Cisco released High Security Alert for IOS XR Software

Cisco has issued a security advisory for a high-severity vulnerability in its IOS XR Software, labeled CVE-2025-20138, with a CVSS...
Read More
CVE-2025-20138  Cisco released High Security Alert for IOS XR Software

400+ IPs Exploiting Multiple SSRF Vulnerabilities

GreyNoise warns of a coordinated increase in the exploitation of Server-Side Request Forgery (SSRF) vulnerabilities across various platforms. "At least...
Read More
400+ IPs Exploiting Multiple SSRF Vulnerabilities

NVIDIA has released update for NVIDIA Riva

NVIDIA has released a software update for Riva to fix security vulnerabilities that could allow privilege escalation, data tampering, denial...
Read More
NVIDIA has released update for NVIDIA Riva

CVE-2025-24201
Apple fixes 0-day exploited in “extremely sophisticated attack”

On Tuesday, Apple fixed a critical zero-day vulnerability affecting nearly all supported iPhones and iPads. The company noted that it...
Read More
CVE-2025-24201  Apple fixes 0-day exploited in “extremely sophisticated attack”

Microsoft’s March 2025 updates fix 7 zero-day, 57 flaws

Microsoft's March 2025 Patch Tuesday update fixes 57 flaws, including seven zero-day exploits, six of which are actively being exploited....
Read More
Microsoft’s March 2025 updates fix 7 zero-day, 57 flaws

Ballista Botnet infects 6000 Unpatched TP-Link Routers

Cato CRTL team said, a new botnet campaign dubbed Ballista target the unpatched TP-Link Archer routers. CVE-2023-1389 is a serious...
Read More
Ballista Botnet infects 6000 Unpatched TP-Link Routers

CVE-2025-24813
Flaw in Apache Tomcat Exposes Servers to RCE

A critical vulnerability, CVE-2025-24813, has been found in Apache Tomcat, which could let attackers execute remote code, leak sensitive data,...
Read More
CVE-2025-24813  Flaw in Apache Tomcat Exposes Servers to RCE

CISA Adds 3 Ivanti Endpoint Manager Bugs to KEV

CISA included three vulnerabilities in Ivanti Endpoint Manager—CVE-2024-13159, CVE-2024-13160, and CVE-2024-13161—in its Known Exploited Vulnerabilities catalog. Federal agencies must address...
Read More
CISA Adds 3 Ivanti Endpoint Manager Bugs to KEV

Ransomware Attacks Set Records in February: New Data Shows

Ransomware attacks reached a record high in February, surpassing previous months, according to a Cyble report. The Cyble report tracked...
Read More
Ransomware Attacks Set Records in February: New Data Shows

Reports say QuaDream sells a platform called REIGN to governments for use in law enforcement. A collection of malware, exploits, and infrastructure called REIGN is explicitly made to exfiltrate data from mobile devices.

Specifics of the QuaDream’s Spyware

According to Citizen Lab researchers, compromised devices belong to “at least five civil society victims of QuaDream’s spyware and exploits in North America, Central Asia, Southeast Asia, Europe, and the Middle East.

Bulgaria, Czechia, Hungary, Ghana, Israel, Mexico, Romania, Singapore, United Arab Emirates, and Uzbekistan were among the nations where Citizen Lab could identify operators for QuaDream systems.

In a report from Meta from December 2022, QuaDream was referenced. 250 accounts connected to the company were purportedly removed as a result.

The report claims that Meta saw QuaDream testing how to break into iOS and Android mobile devices to ” exfiltrate various types of data, including messages, photos, video and audio files, and geolocation.”

“The captured samples targeted iOS devices, specifically iOS 14, but there were indications that some of the code could also be used on Android devices”, reports Microsoft.

“Victims include journalists, political opposition figures, and an NGO worker. We are not naming the victims at this time.”

Notably, to avoid detection, the surveillance malware used in this campaign, identified by Microsoft as “KingsPawn,” was also built to destroy itself after use and wipe out any traces on the iPhones of victims.

“We found that the spyware also contains a self-destruct feature that cleans up various traces left behind by the spyware itself,”

The exploit was deployed as a zero-day against iOS versions 14.4 and 14.4.2 and possibly other versions. The suspected exploit, which we call ENDOFDAYS, appears to use invisible iCloud calendar invitations sent to victims from the spyware’s operator. Citizen Lab said.

“Our analysis of the self-destruct feature revealed a process name used by the spyware, which we discovered on victim devices.”

Additionally, spyware has a wide range of functions, such as recording calls and surrounding audio and enabling threat actors to search the victims’ cell phones.

Capabilities of QuaDream’s Spyware

  • Get device information (such as iOS version and battery status)
  • Wi-Fi information (such as SSID and airplane mode status)
  • Cellular information (such as carrier, SIM card data, and phone number)
  • Search for and retrieve files
  • Use the device camera in the background
  • Get device location
  • Monitor phone calls
  • Access the iOS keychain
  • Generate an iCloud time-based one-time password (TOTP)

It’s crucial to practice basic cyber hygiene to avoid mobile device compromise. The latest software updates for the device, enabling automatic software updates if available, installing anti-malware software, and being cautious about not clicking links in any unexpected or suspicious communications are all aspects of specific best practices.

“Lockdown Mode offers enhanced security for iOS devices by reducing the attack surface available to threat actors,” researchers recommend.

Check Also

CYFIRMA

FinStealer Malware Targets Indian Bank’s Mobile Users, Stealing Credentials

CYFIRMA analysis reveals a sophisticated malware campaign that exploits a major Indian bank’s brand through …

Leave a Reply

Your email address will not be published. Required fields are marked *