Loading story…
Apple and France's CERT-FR have confirmed four separate waves of mercenary spyware attacks targeting high-profile individuals in France in 2025. The attacks leveraged zero-day vulnerabilities, including a recent chain involving CVE-2025-43300 (Apple iOS) and CVE-2025-55177 (WhatsApp), and required no user interaction. Apple has issued targeted threat notifications and recommends immediate security actions for affected users.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
Initial story creation
6 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcesecurityaffairs.com
Open sourcesecurityonline.info
Open sourcethehackernews.com
Open sourcedarkreading.com
Open sourcebleepingcomputer.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Apple has backported a fix for CVE-2025-43300, an ImageIO out-of-bounds write vulnerability exploited in sophisticated attacks targeting specific individuals. The flaw was chained with a WhatsApp vulnerability (CVE-2025-55177) in highly-targeted spyware campaigns affecting fewer than 200 users. Updates are now available for both current and older iOS, iPadOS, and macOS devices.
Jun 29, 2026
Apple sent a new round of threat notifications to users it believes were targeted by **mercenary spyware** capable of compromising `iPhone`, `iPad`, and `Mac` devices. The company said the latest alerts reached customers in **110 countries**, and that it has now notified users in **more than 150 countries** since launching the program. The updated warning process includes a **lock-screen push notification**, an email, and a notice on the user’s Apple account page, reflecting a broader effort to ensure suspected victims recognize the seriousness of the targeting. Apple’s guidance tells recipients to seek expert help and enable **Lockdown Mode**, a hardened security setting designed for people at elevated risk of targeted attacks. According to Apple, it has not observed a case in which a device was successfully compromised while Lockdown Mode was enabled. Researchers said the stronger notification flow can help victims identify spyware targeting earlier and may support wider investigations into abuse by governments and commercial surveillance vendors.
Aug 20, 2026
Security researchers have observed a significant increase in mobile malware and spyware activity affecting both Android and Apple devices in late September 2025. According to AhnLab’s ASEC Blog, the fourth week of September saw a notable rise in malicious Android APKs, with particular targeting in regions such as Indonesia and Vietnam. Attackers have been leveraging smishing campaigns to distribute malware, often disguising malicious applications as legitimate software, including those related to OnePlus OxygenOS. These campaigns aim to steal sensitive user data, credentials, and financial information from unsuspecting victims. Concurrently, a French government advisory highlighted a surge in sophisticated spyware attacks against Apple users, specifically those with iCloud-linked devices. The advisory, reported by Zimperium and originally covered by Dark Reading, revealed that attackers are exploiting zero-day vulnerabilities in Apple’s ecosystem. Victims often receive threat notifications from Apple months after the initial compromise, indicating a delay in detection and response. The French CERT-FR warned that these spyware campaigns are highly targeted and may involve advanced persistent threat actors. The exploitation of zero-day vulnerabilities allows attackers to bypass traditional security measures and gain persistent access to devices. Both Android and Apple users are at risk, with attackers employing a variety of social engineering tactics, including phishing and smishing, to lure victims into installing malicious payloads. The increase in mobile threats underscores the need for heightened vigilance among users and organizations, particularly in regions identified as hotspots for malware distribution. Security experts recommend regular software updates, the use of reputable security solutions, and user education to mitigate the risk of infection. The cross-platform nature of these attacks demonstrates the evolving sophistication of mobile threat actors. Organizations are advised to monitor for indicators of compromise and to respond swiftly to any signs of unauthorized access. The reports from both AhnLab and Zimperium highlight the global scale of the threat, with attackers adapting their techniques to exploit vulnerabilities in both major mobile operating systems. The ongoing campaigns serve as a reminder of the critical importance of mobile security in the current threat landscape.
Jun 29, 2026