CISA Alerts: iOS Zero‑Click Flaw Actively Exploited
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued a high-priority alert regarding a critical zero-click vulnerability in Apple’s ecosystem, tracked as CVE-2025-43200 . This vulnerability, which has now been patched, allowed…
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued a high-priority alert regarding a critical zero-click vulnerability in Apple’s ecosystem, tracked as CVE-2025-43200 . This vulnerability, which has now been patched, allowed attackers to compromise devices running iOS, iPadOS, macOS, watchOS, and visionOS without user interaction.
The vulnerability originated from a logic issue in Apple’s Messages app, particularly when handling maliciously crafted media shared via iCloud Links. Exploiting this flaw enabled attackers to install spyware by sending a malicious media file to a target device without requiring any user action. Once activated, the exploit allowed for remote code execution and complete device compromise without the user's knowledge.
Citizen Lab identified the use of Graphite spyware, developed by Paragon Solutions, exploiting this vulnerability. The spyware targeted several European journalists, with forensic verification confirming the attacks. The infrastructure used for these attacks was traced to a command-and-control server associated with Paragon’s operations.
The vulnerability originated from a logic issue in Apple’s Messages app, particularly when handling maliciously crafted media shared via iCloud Links.
The Italian government has terminated its relationship with Paragon amid increasing scrutiny. The Graphite spyware can access messages, emails, photos, and more, posing significant risks to journalistic integrity and freedom of the press.
Apple addressed CVE-2025-43200 with updates in iOS 18.3.1 and related systems on February 10, 2025. CISA requires all U.S. federal agencies to implement the mitigations by Tue, Jul 7, 2025, or discontinue device use if not feasible. Users are strongly encouraged to update their devices promptly.
Individuals receiving threat notifications should seek assistance from organizations such as Access Now’s Digital Security Helpline or Amnesty International’s Security Lab. This incident highlights the need for enhanced regulatory oversight to protect press freedom and address the rising threat of commercial spyware.
Based on reporting by GBHackers.