Google Uncovers More Zero-Day Exploits Used for Spyware Installation on Android and iOS Devices

Google's Threat Analysis Group (TAG) has discovered two separate campaigns that used zero-day vulnerabilities in Android, iOS, and Chrome to install commercial spyware and malicious apps on targets' devices. The attackers used text messages to redirect victims to legitimate shipment websites before exploiting vulnerabilities to drop a payload allowing them to track the victims' location and install spyware. The campaigns were highly-targeted and took advantage of the time gap between the release of fixes and their deployment on end-user devices. Google is actively tracking more than 30 vendors known to sell surveillance capabilities or exploits to government-sponsored threat actors worldwide.