Loading story…
Multiple reports indicate that mercenary spyware operations have begun targeting not only traditional victims such as journalists and activists, but also the developers and security researchers who build and analyze surveillance tools. Apple issued high-confidence threat notifications to iOS exploit developers, warning them of government spyware targeting their devices. This marks a notable escalation in the mercenary spyware ecosystem, as attackers are now focusing on individuals with deep technical knowledge and access to sensitive information about exploit development.
The commercial spyware market continues to thrive, with unpatched vulnerabilities fueling rapid innovation and deployment of new attack techniques. Security researchers have documented a record number of zero-day vulnerabilities exploited in the wild, many linked to commercial surveillance vendors. The targeting of exploit developers suggests a coordinated campaign within the cybersecurity community, highlighting the growing risks faced by those at the forefront of digital defense and offensive tool creation.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
Apple notified an iOS exploit developer that they had been targeted by government-grade spyware, indicating a mercenary spyware operator had attempted or carried out an attack against the researcher. Multiple reports describe this as an unusual case of spyware being used against someone who develops iOS exploits.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Investigations and legal filings described a growing **mercenary spyware** market in which private vendors developed and sold intrusion capabilities to government customers, with **NSO Group** emerging as the best-known example but not the only one. Reporting tied NSO’s **Pegasus** spyware to attacks on activists, journalists, and government personnel, including the targeting of UAE activist Ahmed Mansoor and more than **1,400 devices** via a WhatsApp exploit that reportedly required no answer from the victim. Microsoft, Google, Cisco, GitHub, LinkedIn, VMware, and others backed WhatsApp’s lawsuit against NSO, arguing the company should not receive sovereign immunity for operating as a private offensive cyber actor, while broader reporting said Facebook had identified **seven** spyware firms targeting roughly **50,000** people across its platforms. Separate investigations showed the industry stretching beyond NSO into Europe and Asia. Lighthouse Reports linked Italy’s **RCS Lab** and its Tykelab unit to covert mobile-phone tracking through telecom signaling weaknesses and to **Hermit** spyware infrastructure, while Citizen Lab and Motherboard connected a fake WhatsApp phishing campaign to Italian vendor **Cy4Gate** and its **Epeius** lawful-intercept product. Earlier reporting on **Hacking Team** and allegations about **APT17** selling stolen data underscored how surveillance and intrusion capabilities have been commercialized, repackaged, and marketed across borders, despite repeated scandals, lawsuits, and sanctions aimed at curbing abuse.
Aug 15, 2026
Apple sent a new round of threat notifications to users it believes were targeted by **mercenary spyware** capable of compromising `iPhone`, `iPad`, and `Mac` devices. The company said the latest alerts reached customers in **110 countries**, and that it has now notified users in **more than 150 countries** since launching the program. The updated warning process includes a **lock-screen push notification**, an email, and a notice on the user’s Apple account page, reflecting a broader effort to ensure suspected victims recognize the seriousness of the targeting. Apple’s guidance tells recipients to seek expert help and enable **Lockdown Mode**, a hardened security setting designed for people at elevated risk of targeted attacks. According to Apple, it has not observed a case in which a device was successfully compromised while Lockdown Mode was enabled. Researchers said the stronger notification flow can help victims identify spyware targeting earlier and may support wider investigations into abuse by governments and commercial surveillance vendors.
Aug 20, 2026
Security researchers have observed a significant increase in mobile malware and spyware activity affecting both Android and Apple devices in late September 2025. According to AhnLab’s ASEC Blog, the fourth week of September saw a notable rise in malicious Android APKs, with particular targeting in regions such as Indonesia and Vietnam. Attackers have been leveraging smishing campaigns to distribute malware, often disguising malicious applications as legitimate software, including those related to OnePlus OxygenOS. These campaigns aim to steal sensitive user data, credentials, and financial information from unsuspecting victims. Concurrently, a French government advisory highlighted a surge in sophisticated spyware attacks against Apple users, specifically those with iCloud-linked devices. The advisory, reported by Zimperium and originally covered by Dark Reading, revealed that attackers are exploiting zero-day vulnerabilities in Apple’s ecosystem. Victims often receive threat notifications from Apple months after the initial compromise, indicating a delay in detection and response. The French CERT-FR warned that these spyware campaigns are highly targeted and may involve advanced persistent threat actors. The exploitation of zero-day vulnerabilities allows attackers to bypass traditional security measures and gain persistent access to devices. Both Android and Apple users are at risk, with attackers employing a variety of social engineering tactics, including phishing and smishing, to lure victims into installing malicious payloads. The increase in mobile threats underscores the need for heightened vigilance among users and organizations, particularly in regions identified as hotspots for malware distribution. Security experts recommend regular software updates, the use of reputable security solutions, and user education to mitigate the risk of infection. The cross-platform nature of these attacks demonstrates the evolving sophistication of mobile threat actors. Organizations are advised to monitor for indicators of compromise and to respond swiftly to any signs of unauthorized access. The reports from both AhnLab and Zimperium highlight the global scale of the threat, with attackers adapting their techniques to exploit vulnerabilities in both major mobile operating systems. The ongoing campaigns serve as a reminder of the critical importance of mobile security in the current threat landscape.
Jun 29, 2026