Government Hackers Exploit iPhone Vulnerabilities (A Report by Google)

Google’s Threat Analysis Group recently published a report revealing that government hackers exploited three unknown vulnerabilities in Apple’s iPhone operating system last year. These hackers targeted victims using spyware developed by Variston, a Barcelona-based startup.

Exploitation of iPhone Zero-Days

The term “zero-days” refers to vulnerabilities unknown to Apple at the time they were exploited. In this case, the hacking tools developed by Variston were used in a campaign targeting iPhones in Indonesia.

The attack involved sending an SMS with a malicious link, which, upon clicking, infected the target’s phone with spyware and redirected them to a news article.

Variston’s Role and Google’s Findings

Variston has been under Google’s radar, with their malware being analyzed twice in 2022 and 2023. The company has reportedly lost multiple employees over the past year.

Google’s report also mentions Variston’s collaboration with other organizations, including Protected AE, based in the United Arab Emirates, to develop and sell spyware.

The Broader Context of Spyware Use

Google’s report highlights the expanding reach and capabilities of European spyware makers, tracking around 40 such companies. These vendors sell exploits and surveillance software to government customers globally.

The report emphasizes the harm caused by these tools, particularly when used against journalists, human rights defenders, and politicians, threatening freedom of speech and the integrity of elections worldwide.

Google’s Commitment to Disrupting Hacking Campaigns

Google has expressed its commitment to disrupting hacking campaigns conducted with these tools, given their links to targeted surveillance of high-risk users.

The company stresses the broader implications of such focused targeting on global freedom of speech, a free press, and election integrity.