iOS Zero-Day Exploit Chain Leveraged by Mercenary Spyware for Device Surveillance
A recent security vulnerability involving an iOS zero-day exploit chain has been identified as being linked to mercenary spyware, which enables covert device surveillance on high-risk users.
A recent security vulnerability involving an iOS zero-day exploit chain has been identified as being linked to mercenary spyware, which enables covert device surveillance on high-risk users.
The exploit chain, attributed to the surveillance vendor Intellexa, employs multiple previously unknown vulnerabilities. It transitions from a single link click in Safari to full spyware deployment on targeted iPhones.
This operation has targeted civil society and political entities, demonstrating how well-funded spyware vendors continue to exploit browser and kernel vulnerabilities for long-term monitoring.
The attack initiates with a malicious one-time link, typically delivered via encrypted messaging apps. When the link is opened in Safari, it triggers a remote code execution flaw, identified as CVE-2023-41993.
This initial stage utilizes a shared exploitation framework, JSKit, to achieve arbitrary read and write capabilities in the Safari renderer. It then transitions to native code execution on modern iOS versions.
JSKit has been employed by other surveillance vendors and state-backed actors since 2021, indicating an active market for reusable exploit components.
Google Cloud security researchers identified the entire exploit chain in devices located in Egypt. The exploit, internally codenamed "smack" by Intellexa, was used to deploy the Predator spyware family.
The exploit chain, attributed to the surveillance vendor Intellexa, employs multiple previously unknown vulnerabilities.
After the browser is compromised, the exploit proceeds to a second stage that escapes the Safari sandbox and escalates privileges using kernel vulnerabilities CVE-2023-41991 and CVE-2023-41992.
This stage enables kernel memory read and write access for a third-stage payload known as PREYHUNTER, which includes modules for verifying the victim device, avoiding analysis, and conducting early surveillance activities.
The PREYHUNTER helper module interacts with other components via a Unix socket located at /tmp/helper.sock and installs hooks through internal frameworks named DMHooker and UMHooker.
These hooks attach to sensitive system paths and services, allowing for audio capture, input logging, and covert checks before deploying a full Predator implant.
int fd = socket(AF_UNIX, SOCK_STREAM, 0); struct sockaddr_un addr = {0}; addr.sun_family = AF_UNIX; strcpy(addr.sun_path, "/tmp/helper.sock"); bind(fd, (struct sockaddr *)&addr, sizeof(addr)); listen(fd, 5);
The watcher module continuously monitors for research or debugging indicators, such as developer mode, jailbreak tools, security applications, custom root CAs, and HTTP proxies.
CVE Type Component / Vendor Role in Chain Outcome
CVE-2023-41993 Remote Code Execution (RCE) Safari / Apple iOS Initial browser compromise via JSKit Code execution in Safari process
CVE-2023-41992 Sandbox Escape + LPE Kernel / Apple iOS Breakout from Safari sandbox System-level code execution
CVE-2023-41991 Local Privilege Escalation Kernel / Apple iOS Kernel privilege elevation and persistence Kernel read/write for spyware
If any indicators of research or debugging are detected, the exploit chain halts to minimize forensic traces. This sophisticated approach, combined with kernel-level access, indicates a mature ecosystem where exploit developers, brokers, and spyware operators work together to maintain stealth and persistence in iOS surveillance campaigns.
Based on reporting by Cyber Security News.