Global Spyware Campaigns Exploit Zero-Day Vulnerabilities on Android and iOS Devices

Commercial spyware vendors exploited zero-day vulnerabilities on Android and iOS devices in two distinct campaigns that were highly targeted and limited. The exploits were used to arm governments and target dissidents, journalists, human rights workers, and opposition party politicians. The campaigns used shortened links over SMS messages to redirect recipients to web pages hosting exploits for Android or iOS. The exploits leveraged multiple bugs, including zero-days, to install malicious toolkits capable of harvesting data from chat and browser applications. The scale of the campaigns and the nature of the targets are currently unknown.