ClosedHighPatched
Day · Jul 24, 2023
Operation Triangulation: zero-click iMessage spyware on Kaspersky's iPhones
Apple iOS (and other Apple OSes sharing the bugs)
Updates on Jul 24, 2023
Apple fixes CVE-2023-38606 (iOS 16.6); KEV entry follows on July 26
Source
Summary
Kaspersky found a years-long zero-click iMessage campaign on its own staff's iPhones. The chain used several Apple zero-days, including a bypass of hardware memory protections through undocumented MMIO registers (CVE-2023-38606), which was revealed at 37C3 in December 2023.
Read the full incident →
