By Ryan Ravenell

Apple has issued an emergency security patch update for a spyware that targeted iOS, macOS (OSX), and watchOS, and is urging millions of users around the world to update their technology.

In an analysis conducted by internet security firm Citizen Lab, the exploit–which they referred to as FORCEDENTRY–allowed hackers to access iPhones and other Apple devices without user interaction. The hackers sent specially crafted files believed to be GIFs, which were actually Adobe PDFs that had malicious code implemented. They were sent through iMessage, Apple’s messaging service.

“Our finding also highlights the paramount importance of securing popular messaging apps,” the Citizen Lab wrote in a statement about application security. “Ubiquitous chat apps have become a major target for the most sophisticated threat actors, including nation state espionage operations and the mercenary spyware companies that service them.”

The Pegasus spyware was developed as a ‘zero-day zero-click’ surveillance tool by Israeli cybersecurity firm NSO Group, and has been active since February 2021, Citizen Lab stated. It has the ability to hack into devices and harvest information from users, and can intercept phone calls and messages. The spyware does not require a malicious link to be sent to users in order for it to function properly.

The exploit, which was based on how images are loaded into iMessage, was announced by the Lab last Tuesday, and Apple immediately began configuring the patch amid the announcement. It was made available to millions of users on Monday night.

Citizen Lab discovered FORCEDENTRY after examining the phone of a Saudi political activist, whose device appeared to have been infected with the exploit since February.

According to Apple, the exploit affects iPhones with iOS versions prior to 14.8, Mac computers with operating system versions prior to OSX Big Sur 11.6, Security Update 2021-005 Catalina, and Apple Watches prior to watchOS 7.6.2.

In an emailed statement, Apple Head of Security Engineering and Architecture Ivan Krstić wrote, “Attacks like the ones described are highly sophisticated, cost millions of dollars to develop, often have a short shelf life, and are used to target specific individuals.”

In a statement to international news organization Reuters, the NSO Group stated that it would “continue to provide intelligence and law enforcement agencies around the world with life-saving technologies to fight terror and crime.” The group did not confirm nor deny any involvement with the spyware.

The NSO Group has become a subject of controversy for their Pegasus spyware, with human rights activists and journalists becoming targets of malicious program users.

In 2019, Facebook filed a lawsuit against NSO Group, accusing them of being complicit in the hack of 1,400 mobile devices using WhatsApp; the NSO Group has since disputed these allegations.

The latest news came prior to the release of the iPhone 13, Apple’s latest model for the notable phone brand. iOS 15 will be available to users on September 20.