Operation Triangulation Used Four Zero-Days to Spy on iPhones

Researchers disclosed Operation Triangulation, an iPhone espionage campaign that infected devices through iMessage and deployed a sophisticated spyware implant on iOS. Reporting tied the operation to a chain of four zero-day vulnerabilities, including flaws in Apple’s processing of messages and a hardware-based feature that enabled attackers to bypass protections that were largely undocumented outside Apple. Kaspersky said the malware targeted iPhones used by its employees, while later technical analysis and conference presentations detailed how the implant gained code execution, escalated privileges, and maintained stealth on compromised devices.

The campaign quickly drew geopolitical attention after Russian authorities accused Apple of cooperating with the NSA in the spying operation, an allegation that was widely reported but not substantiated by public technical evidence. Subsequent coverage focused on the exploit kit sometimes referred to as Coruna, with Kaspersky later saying it had found no signs that the toolkit was created by the United States. The case remains notable for showing that attackers combined multiple iOS zero-days with obscure Apple hardware behavior to build a highly advanced surveillance platform against iPhone users.