Patched bugs in Apple and Google software exploited in spyware attacks: Report

Security bugs in Apple’s iOS and Google’s Chrome were found to have been exploited by threat actors to infect devices with Cytrox’s Predator spyware. The bugs, that were recently patched, were abused as part of an exploit chain to install the spyware, Citizen Lab and Google’s Threat Analysis Group shared in a blog post. Some of the domains used to target the devices identified “appeared to be geared at targets in countries previously identified as Cytrox Predator customers, including Egypt, Greece, and Madagascar” Citizen Lab and Google’s Threat Analysis Group shared. “Given that Egypt is a known customer of Cytrox’s Predator spyware, and the spyware was delivered via network injection from a device located physically inside Egypt, we attribute the network injection attack to the Egyptian government with high confidence,” Citizen Lab said. Citizen Lab security researchers also disclosed two other zero-day vulnerabilities fixed by Apple in its emergency security updates that were abused as part of another zero-click exploit to infect fully patched iPhones with NSO Group’s Pegasus.