Loading story…
Apple issued emergency updates for iOS, iPadOS, macOS, watchOS, and Safari to fix FORCEDENTRY, a zero-click iMessage exploit used to deploy NSO Group’s Pegasus spyware. The attack abused a malicious file disguised as a GIF that was actually a PDF, triggering CVE-2021-30860 in Apple’s CoreGraphics JBIG2 parser and allowing code execution without user interaction. Citizen Lab linked the exploit to infections on the iPhones of nine Bahraini activists, including members of opposition and human rights groups, and attributed at least part of the activity to a Pegasus operator associated with the Bahraini government.
Google Project Zero described FORCEDENTRY as one of the most technically sophisticated in-the-wild exploits it had examined. Researchers said the exploit used an integer overflow in JBIG2 processing to corrupt memory, unbind a bitmap, and gain arbitrary read/write access, then repurposed JBIG2 refinement operations as logic gates to build a miniature computation environment inside the parser with more than 70,000 segment commands. Apple fixed the flaw in iOS 14.8, later narrowed the ImageIO formats reachable from IMTranscoderAgent in iOS 14.8.1, and moved GIF decoding fully into BlastDoor in iOS 15.0 to further reduce the attack surface.
See which actors are running it and whether you're in range.
7 events from the most recent confirmed update back to the earliest known activity.
On December 1, 2021, Google Project Zero published a detailed reverse-engineering of NSO Group's FORCEDENTRY exploit, describing how a fake GIF carrying a disguised PDF triggered CVE-2021-30860 in the CoreGraphics JBIG2 parser. The researchers said the exploit effectively built a small virtual computer inside the parser using more than 70,000 JBIG2 segment commands to achieve arbitrary memory access.
After the September 2021 patch, Apple further reduced the ImageIO formats reachable from IMTranscoderAgent in iOS 14.8.1 and moved GIF decoding fully into BlastDoor in iOS 15.0. These changes were described as additional mitigations against the exploit path used by FORCEDENTRY.
Citizen Lab publicly reported that NSO Group zero-click iPhone exploits, including KISMET and FORCEDENTRY, had been used to hack nine Bahraini activists. The report said the attacks bypassed Apple's BlastDoor protections and tied parts of the activity to the Bahraini government.
On September 13, 2021, Apple released emergency security updates including a fix for CVE-2021-30860, a CoreGraphics JBIG2 parsing flaw exploited by NSO Group's FORCEDENTRY zero-click iMessage chain. Apple also patched CVE-2021-30858, a WebKit use-after-free vulnerability reported as potentially exploited in the wild.
Citizen Lab recovered a Pegasus sample from an NSO Group zero-click iMessage attack targeting a Saudi activist. That recovered sample later enabled detailed technical analysis of the FORCEDENTRY exploit chain.
Citizen Lab found that nine Bahraini activists' iPhones were successfully infected with NSO Group's Pegasus spyware between June 2020 and February 2021. The victims included members of Waad, the Bahrain Center for Human Rights, Al Wefaq, and Bahraini dissidents living in exile in London.
Citizen Lab assessed with high confidence that at least four of the compromises were carried out by a Pegasus operator called LULU linked to the Bahraini government. The investigation also documented command-and-control infrastructure tied to that operator and linked five victim phone numbers to the Pegasus Project target list.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 22 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
4 references tracked. Mallory keeps watching after this page renders.
citizenlab.ca
Open sourcegoogleprojectzero.blogspot.com
Open sourceprojectzero.google
Open sourcecomputerweekly.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Trend Micro reported that the Pegasus spyware platform used a **zero-click** iPhone exploit known as **ForcedEntry** to compromise Apple devices through **iMessage** without requiring user interaction. The exploit chain abused how iOS processed maliciously crafted message content, allowing attackers to gain code execution and install surveillance tooling on targeted phones. The research tied ForcedEntry to Pegasus operations and highlighted the sophistication of the attack, including its use against fully updated iPhones at the time. The findings underscored the risk posed by commercial spyware leveraging previously unknown vulnerabilities in widely deployed mobile platforms, enabling covert access to messages, calls, and other sensitive device data.
Jun 29, 2026
Citizen Lab documented multiple Pegasus infections against civil society targets, including New York Times journalist Ben Hubbard and four Jordanian human rights defenders, lawyers, and journalists. Hubbard’s iPhone was reportedly infected twice through zero-click iMessage exploit chains tied to `KISMET` and `FORCEDENTRY`, after earlier SMS and WhatsApp lure attempts linked to a Saudi-associated operator. In Jordan, researchers found repeated Pegasus targeting between 2019 and 2021 and assessed that two operators, `MANSAF` and `BLACKIRIS`, were likely connected to Jordanian government agencies; one successful iPhone compromise occurred even after Apple sued NSO Group and began notifying victims. Technical reporting and forensic guidance showed Pegasus was built for covert, persistent surveillance across mobile platforms. Google previously identified the Android variant `Chrysaor` on a small number of devices, describing capabilities including privilege escalation, persistence, keylogging, screenshot capture, data theft, and covert microphone use. Reverse-engineering of Pegasus for Android detailed command-and-control over HTTP with encrypted values, SMS-based command execution disguised as verification texts, exfiltration of messages, contacts, call logs, emails, and app data, plus live audio recording, screenshot capture, camera access, and self-deletion features; Amnesty International separately published forensic methodology to help investigators detect Pegasus infections.
Aug 15, 2026
Apple disclosed multiple security fixes for supported iPhone and iPad devices, including `CVE-2025-24200`, which allowed a physical attacker to disable USB Restricted Mode on a locked device, and `CVE-2025-43200`, a logic flaw triggered by malicious photo or video content shared through an iCloud Link. Apple said both vulnerabilities may have been exploited in extremely sophisticated attacks against specific targeted individuals, and credited Citizen Lab researcher Bill Marczak for reporting the USB Restricted Mode issue. Further reporting tied `CVE-2025-43200` to a zero-click Messages exploitation chain used to install Paragon's **Graphite** spyware on the phones of several journalists in Europe. Apple urged users to update affected platforms, while a separate later advisory for `iOS 26.0.1` and `iPadOS 26.0.1` fixed `CVE-2025-43400`, an out-of-bounds write in font processing that could cause app crashes or memory corruption on supported iPhone and iPad models.
Jul 24, 2026