Threat Intel
Pegasus Zero‑Click Spyware: Detection and Mitigation for iOS and Android
Pegasus has been infecting mobile devices via zero‑click exploits, silently collecting messages, calls, location and audio. The threat remains active on both iOS and Android. Defenders should verify device integrity, monitor for abnormal data exfiltration, and apply vendor‑specific hardening steps.
What happened
Pegasus, a state‑grade spyware suite, has been delivering payloads to iOS and Android devices without user interaction. The infection vector relies on zero‑click vulnerabilities that bypass authentication and install a stealth kernel‑level component, granting the attacker full read/write access to the device.
Impact
Once installed, Pegasus harvests SMS, MMS, call logs, contacts, GPS coordinates, and microphone audio. It can also intercept encrypted messaging apps and exfiltrate data over covert channels. The spyware operates with near‑zero latency, making detection difficult for end users and standard security tools.
Detection Steps for Defenders
- Run a full integrity check against the latest iOS/Android release hashes. Look for unsigned kernel extensions or modified system binaries.
- Enable device‑level logging (e.g., iOS Device Management logs, Android Device Administration logs) and look for abnormal background processes or high‑privilege services that were not installed by the user.
- Monitor network traffic for connections to unfamiliar IP ranges, especially those with high outbound data rates or encrypted tunnels without a clear business purpose.
- Use mobile forensics tools (e.g., Cellebrite, Oxygen Forensics) to extract a forensic image and search for known Pegasus artefacts such as the “Pegasus” process or hidden files in system directories.
- Apply the latest OS patches immediately. Disable unused services (e.g., Bluetooth, NFC) and enforce strict MDM policies that restrict app installation and enforce device encryption.
Mitigation and Response
Upon detection, isolate the device from the network, perform a secure wipe, and reinstall the OS from a trusted source. Conduct a post‑incident forensic analysis to identify the exfiltration path and update threat intelligence feeds to block related indicators of compromise. Regularly train staff on zero‑click threat awareness and maintain an up‑to‑date incident response plan that includes mobile device containment procedures.
Related articles
Mantax Otax Malware Hybridizes Ransomware, Spyware, and Psychological Harassment on Android
Security researchers have uncovered Mantax Otax, an aggressive Android malware strain combining file encryption, data exfiltration, and psychological harassment techniques. Operating primarily through malicious side-loaded APKs, the threat abuses Accessibility services and GitHub to establish C2 connections, harvest sensitive user credentials, and lock files on older Android builds. Additionally, the malware deploys loud text-to-speech audio and jumpscare overlays to coerce victims into paying ransom demands.
Read briefing
Zero-Click Candiru Spyware Reaches Al Jazeera via Targeted Online Ads
Researchers confirm that Candiru spyware infected at least 45 Al Jazeera devices through invisible ads, requiring no user interaction. The attack chain began with a Discover‑Tech ad server that identified targets and delivered malicious code to browsers or apps. Defenders should audit ad networks, block suspicious ad domains, and monitor for unexpected outbound connections to known spyware command‑and‑control hosts.
Read briefing
Fraudulent Trading Apps Targeting iOS and Android via UniApp Framework
Group‑IB uncovered a large‑scale fraud campaign that distributed counterfeit trading applications on iOS and Android. The malicious apps were published through official app stores and phishing sites using the UniApp framework. Defenders should verify app authenticity, monitor for duplicate app listings, and block associated domains.
Read briefing
Corp MDM Android Spyware Targets Logistics Sector via Fake Google Play Pages
A targeted campaign is distributing Android spyware known as Corp MDM via fraudulent Google Play landing pages impersonating logistics brands. The malware, packaged as a system service, is designed to intercept inbound SMS traffic, manipulate call routing, and maintain persistent background execution using a hard-coded command-and-control infrastructure.
Read briefing