Loading story…
Trend Micro reported that the Pegasus spyware platform used a zero-click iPhone exploit known as ForcedEntry to compromise Apple devices through iMessage without requiring user interaction. The exploit chain abused how iOS processed maliciously crafted message content, allowing attackers to gain code execution and install surveillance tooling on targeted phones.
The research tied ForcedEntry to Pegasus operations and highlighted the sophistication of the attack, including its use against fully updated iPhones at the time. The findings underscored the risk posed by commercial spyware leveraging previously unknown vulnerabilities in widely deployed mobile platforms, enabling covert access to messages, calls, and other sensitive device data.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
Trend Micro published research analyzing the ForcedEntry zero-click iPhone exploit used by Pegasus spyware, providing technical details about the exploit chain and its use against Apple devices.
Apple issued iOS 14.8 and corresponding macOS and watchOS security updates to fix CVE-2021-30860, a zero-day flaw affecting iPhones, iPads, Macs, and Apple Watches that may have been actively exploited. The patch followed Citizen Lab's discovery of ForcedEntry exploit artifacts linked with high confidence to NSO Group's Pegasus spyware.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Apple issued emergency updates for iOS, iPadOS, macOS, watchOS, and Safari to fix **FORCEDENTRY**, a zero-click iMessage exploit used to deploy NSO Group’s Pegasus spyware. The attack abused a malicious file disguised as a GIF that was actually a PDF, triggering `CVE-2021-30860` in Apple’s CoreGraphics JBIG2 parser and allowing code execution without user interaction. Citizen Lab linked the exploit to infections on the iPhones of nine Bahraini activists, including members of opposition and human rights groups, and attributed at least part of the activity to a Pegasus operator associated with the Bahraini government. Google Project Zero described FORCEDENTRY as one of the most technically sophisticated in-the-wild exploits it had examined. Researchers said the exploit used an integer overflow in JBIG2 processing to corrupt memory, unbind a bitmap, and gain arbitrary read/write access, then repurposed JBIG2 refinement operations as logic gates to build a miniature computation environment inside the parser with more than 70,000 segment commands. Apple fixed the flaw in iOS 14.8, later narrowed the ImageIO formats reachable from `IMTranscoderAgent` in iOS 14.8.1, and moved GIF decoding fully into BlastDoor in iOS 15.0 to further reduce the attack surface.
Jun 29, 2026
Citizen Lab documented multiple Pegasus infections against civil society targets, including New York Times journalist Ben Hubbard and four Jordanian human rights defenders, lawyers, and journalists. Hubbard’s iPhone was reportedly infected twice through zero-click iMessage exploit chains tied to `KISMET` and `FORCEDENTRY`, after earlier SMS and WhatsApp lure attempts linked to a Saudi-associated operator. In Jordan, researchers found repeated Pegasus targeting between 2019 and 2021 and assessed that two operators, `MANSAF` and `BLACKIRIS`, were likely connected to Jordanian government agencies; one successful iPhone compromise occurred even after Apple sued NSO Group and began notifying victims. Technical reporting and forensic guidance showed Pegasus was built for covert, persistent surveillance across mobile platforms. Google previously identified the Android variant `Chrysaor` on a small number of devices, describing capabilities including privilege escalation, persistence, keylogging, screenshot capture, data theft, and covert microphone use. Reverse-engineering of Pegasus for Android detailed command-and-control over HTTP with encrypted values, SMS-based command execution disguised as verification texts, exfiltration of messages, contacts, call logs, emails, and app data, plus live audio recording, screenshot capture, camera access, and self-deletion features; Amnesty International separately published forensic methodology to help investigators detect Pegasus infections.
Aug 15, 2026
Researchers disclosed **Operation Triangulation**, an iPhone espionage campaign that infected devices through iMessage and deployed a sophisticated spyware implant on iOS. Reporting tied the operation to a chain of **four zero-day vulnerabilities**, including flaws in Apple’s processing of messages and a hardware-based feature that enabled attackers to bypass protections that were largely undocumented outside Apple. Kaspersky said the malware targeted iPhones used by its employees, while later technical analysis and conference presentations detailed how the implant gained code execution, escalated privileges, and maintained stealth on compromised devices. The campaign quickly drew geopolitical attention after Russian authorities accused Apple of cooperating with the **NSA** in the spying operation, an allegation that was widely reported but not substantiated by public technical evidence. Subsequent coverage focused on the exploit kit sometimes referred to as **Coruna**, with Kaspersky later saying it had found **no signs** that the toolkit was created by the United States. The case remains notable for showing that attackers combined multiple iOS zero-days with obscure Apple hardware behavior to build a highly advanced surveillance platform against iPhone users.
Jul 12, 2026