Emergency Apple Updates: Zero-Days Exploited to Deploy Spyware on iPhones

Apple issued emergency security updates to address two zero-day vulnerabilities that were actively exploited in a sophisticated zero-click exploit chain. These vulnerabilities served as entry points for deploying NSO Group’s Pegasus commercial spyware onto fully patched iPhones.

The two identified vulnerabilities, tracked as CVE-2023-41064 and CVE-2023-41061, allowed attackers to compromise iPhones running iOS 16.6, even if they were fully patched. This alarming breach occurred within a Washington DC-based civil society organization through PassKit attachments containing malicious images.

Citizen Lab, a prominent research organization, has named this exploit chain “BLASTPASS.” The concerning aspect of this attack is that it could compromise iPhones running the latest version of iOS (16.6) without requiring any interaction from the victim. The attack method involved PassKit attachments, containing malicious images, sent from the attacker’s iMessage account to the victim’s device.

In response to these critical security breaches, Citizen Lab strongly advises all Apple customers to update their devices immediately. Furthermore, individuals who may be at risk of targeted attacks due to their identity or profession are encouraged to activate Lockdown Mode on their devices.