ClosedPatched
Day · Jun 21, 2023
Operation Triangulation: zero-click iMessage spyware on Kaspersky's iPhones
Apple iOS (and other Apple OSes sharing the bugs)
Updates on Jun 21, 2023
Apple fixes CVE-2023-32434 and CVE-2023-32435; CISA adds them to KEV on June 23
Source
Summary
Kaspersky found a years-long zero-click iMessage campaign on its own staff's iPhones. The chain used several Apple zero-days, including a bypass of hardware memory protections through undocumented MMIO registers (CVE-2023-38606), which was revealed at 37C3 in December 2023.
Read the full incident →
