A new spyware tool reportedly can harvest data from iOS devices and their connected cloud accounts.
The tool, called Pegasus, also works with Android devices. The data it is able to gather even reportedly includes encrypted messages from third-party apps. It does this by fraudulently posing as the user to download their private content.
According to the Financial Times, the tool developed by Israeli firm NSO Group can capture a “much greater trove of information stored beyond the phone in the cloud, such as a full history of a target’s location data, archived messages or photo.”
A tool for governments
NSO Group pitches Pegasus as an assistive tool for governments to use for criminal investigations. This type of functionality previously caused a standoff between Apple and the FBI. That incident occurred after Apple refused to help unlock the iPhone of a suspected terrorist.
Pegasus reportedly can be used regardless of two-factor login, and does not trigger a warning message to users. This means that it could be used on people without their knowledge.
Apple does not deny the tool’s existence. The company told the Financial Times that “some expensive tools may exist to perform targeted attacks on a very small number of devices.” However, Apple said “we do not believe these are useful for widespread attacks against consumers.”
Researchers at Citizen Lab suggest that at least 45 countries have used NSO Group tools. This includes both the U.S. and U.K. NSO Group previously whipped up a WhatsApp exploit.
