FlagThis — Daily Cybersecurity Intelligence Briefing

Apple has issued urgent threat notifications to hundreds of users across 110 countries, alerting them to targeted attacks by mercenary spyware vendors. These campaigns likely employ zero-click or one-click exploit chains leveraging zero-day vulnerabilities in iOS to gain unauthorized system access and exfiltrate sensitive data. Apple utilizes internal telemetry to detect indicators of compromise (IoCs) and associated command-and-control (C2) infrastructure. Affected users are advised to immediately enable Lockdown Mode to minimize the attack surface and disrupt the exploit delivery mechanism and ensure device integrity.

Forensic analysis by Citizen Lab confirmed that Stelios Kouloglou, a member of the EU's PEGA Committee, was twice infected with NSO Group's Pegasus spyware. The campaign utilized advanced mobile exploitation to compromise a device specifically tasked with investigating commercial surveillance abuses. This breach resulted in the potential exfiltration of sensitive European Parliament communications and internal PEGA Committee investigative strategies. The attack demonstrates a targeted retaliatory pattern where commercial spyware is deployed by government customers to monitor and intimidate democratic oversight bodies, compromising the integrity of legislative deliberations and diplomatic security.

Meta has intercepted a targeted spear-phishing campaign by NSO Group aimed at deploying Pegasus spyware to WhatsApp users in Jordan and Lebanon. The attack utilizes sophisticated social engineering templates and malicious redirection URLs to bypass traditional security controls and achieve device compromise. This campaign directly violates a 2025 permanent federal injunction against NSO Group. In response, Meta is pursuing legal contempt motions to enforce judicial orders, moving beyond technical disruption to aggressive litigation to protect user privacy and platform integrity.