Now this is (perhaps) interesting, it seems like China's MSS believes that some CN Gov folks were targeted w/ a (presumably) zero-click exploit through a "foreign" messaging app. They attribute to US NSA (though no mention of why they attribute this way)

The video of @droethlisberger.bsky.social and my @reconmtl.bsky.social 2025 talk, "A Trip to Ancient BABYLON", is now online! It's a fun story about a 2017-era iOS persistence exploit that we found in a Pegasus sample -- on VT (!!)

Recording of our REcon talk about a 2017 iOS persistence exploit used by NSO's Pegasus—and other threat actors too—is out. @billmarczak.org and me of @citizenlab.ca at @reconmtl.bsky.social. youtu.be/ZlopMtjsVRw

The South Korean Ministry of Defense has awarded medals of merit to 11 officers for disobeying direct orders of superiors during the martial law fiasco, orders that they deemed to be contrary to the constitution and endangerment to democracy. www.chosun.com/english/nati...

WhatsApp just announced they patched a very fun zero-click bug (CVE-2025-55177)! WhatsApp assesses that it was used partially in conjunction with the iOS RawCamera DNG vulnerability (CVE-2025-43300). www.whatsapp.com/security/adv...

Excited to talk today at @reconmtl.bsky.social with @droethlisberger.bsky.social about a 2017 iOS persistence exploit used by NSO's Pegasus (and, interestingly, other threat actors too)! 10:00AM in the Grand Salon cfp.recon.cx/recon-2025/t...

Remember when Meta published about an ITW FreeType OOB write vuln (CVE-2025-27363) in March? Turns out, Meta links this vuln to an exploit from spyware vendor Paragon www.securityweek.com/freetype-zer...

Today we’re publishing new findings on Predator spyware, still active despite global sanctions, now with a new client and ties to a Czech entity. Here’s what we found 🧵 www.recordedfuture.com/research/pre...

ICYMI, yesterday we released a report providing a first look at how we found traces of spyware on two journalists' iPhones, traces which we can attribute with high confidence to Paragon's Graphite spyware:

New blog post up on the Rust font loader now shipping in Chrome. I only had a small part in this personally but am proud of the team's work. developer.chrome.com/blog/memory-...

Check out our new @citizenlab.ca report today on Paragon! We got a tip from a collaborator, used it to map out Paragon's infrastructure, and shared with Meta. WhatsApp was able to capture & burn a zero-click, and sent out notifications to targets citizenlab.ca/2025/03/a-fi...

Nice work by Amnesty Security Lab & Google TAG patching three vulnerabilities in Android/Linux kernel USB device drivers that Cellebrite was using to unlock Android devices. Also, it's *scandalous* that Android doesn't have a USB restricted mode like iPhone... securitylab.amnesty.org/latest/2025/...

Update your iPhones.. again! iOS 18.3.1 out today with a fix for an ITW USB restricted mode bypass (via Accessibility) support.apple.com/en-us/122174

President Yoon arrested for masterminding martial law plot

Excellent @eff.org piece on how data brokers get ads-related data to sell (to spyware vendors, etc.) This is something that always mystified me, but after reading this I finally get it!

NSO Group co-founder & owner Omri Lavie speaks about the recent US judge's WhatsApp ruling, the acquisition of competitor Paragon Solutions by AE Industrial Partners & the US-blacklisting of Pegasus spyware maker, amidst shifting 🇺🇸policy under Trump. 👇 vaspanagiotopoulos.substack.com/p/nso-group-...

Rinson Jose's uncle says Jose emailed his family, claiming to be back in Norway, and with a new job.

One interesting detail about our guy Rinson Jose in the new NYTimes article on the pager operation: Israel pressured the US to let Jose flee (though unclear anyone would have stopped him). Still no word on to what extent Jose was aware of the operation.

Tesla is deeply reliant on China, both for manufacturing and sales. But now that its CEO has an official role in the Trump administration, things could get tricky.

Happy holidays to me, I guess

Not many new tangible facts in this CBS News report about the exploding pagers operation. But it was interesting to see that Mossad gave Lesley Stahl an AR-924 pager (or at least the outer casing) -- presumably minus the explosive battery.

Summary judgement for WhatsApp in the NSO "missed call hack" case! The judge found NSO did not meet discovery obligations (in part b/c they did not suitably produce code for their custom WhatsApp client used in the hacks). Thus, a number of key evidentiary questions were resolved in WhatsApp's favor

Everything old is new again 🙂

Pretty clever tactic by Serbian police - apparently they rolled their own very simple Android spyware (NoviSpy), then confiscated and unlocked phones (sometimes using Cellebrite's forensics product) and manually sideloaded the spyware APK onto the devices!

Interesting! Though this is going to drive up BigQuery costs for Certificate Transparency queries 🙁 letsencrypt.org/2024/12/11/e...

Another interesting case of leveraging petty crime for OPSEC (perhaps unintentional this time tho?) Reminds me of how the Hacking Team hacker used a drug addict to buy Bitcoin gift cards to rent servers

NEW REPORT: In a joint investigation with The First Department, we uncovered spyware covertly implanted on the phone of a Russian programmer following his release from Russian custody. citizenlab.ca/2024/12/devi...

NEW REPORT: We investigate the rising trend of gender-based digital transnational repression by drawing on the lived experiences of 85 women human rights defenders living in exile across the globe. Read the full report: citizenlab.ca/2024/12/the-...

Very cool! This will save threat hunters a lot of time.

Last week at CSCW, Catherine Han presented our work on journalists' unmet needs for protecting against harassment online. While the work targeted Twitter/X, it surfaces several nuances in users' needs that span future platforms as well (e.g., not wanting to filter out threats or visibly block users)

Even though I knew most of what was coming next, I still felt like I was on the edge of my seat. Would recommend this documentary for those with an HBO/Max subscription

Make Pegasus Great Again? www.intelligenceonline.com/surveillance...

Heard of Kaspersky "becoming aware" of an iOS hack? Or the FSB being paranoid Apple deliberately left bugs? Well, colleague @billmarczak.org has a spicy take on the Triangulation Group saga. https://medium.com/@billmarczak/triangulation-did-the-nsa-fail-to-learn-the-lessons-of-nso-5f36d251d02e