ZecOps, a cyber-security firm, said today it detected attacks against high-profile targets using a new iOS email exploit. Apple is currently investigating the matter, and the company is preparing a security update to be made available soon.
In a report published today, ZecOps said it found evidence that hackers have been using an iOS bug since at least January 2018. Researchers say the new iOS exploit appears to have been leveraged as part of malformed emails sent to high-profile iOS users. ZecOps researchers say the attack is a zero-click exploit that doesn’t require users to interact with the email, with the exploit triggering once the user receives the email or the user opens the Apple Mail app…
“We believe that these attacks are correlative with at least one nation-state threat operator or a nation-state that purchased the exploit from a third-party researcher in a Proof of Concept (POC) grade and used ‘as-is’ or with minor modifications,” ZecOps said. ZecOps did not want to name the “nation-state” group who they believe was exploiting this bug…
ZecOps said it notified Apple on February 19. Initially, ZecOps reported what appeared to be a regular security bug, and worked with Apple to patch the issue. Apple published a patch for this bug on April 15, with the release of iOS 13.4.5 beta.
MacDailyNews Take: Obviously, stop using Mail on your iPhone, iPad, and/or iPod touch for now and as soon as iOS 13.4.5 and iPadOS 13.4.5 become available to the public, users should upgrade ASAP. Read more about this issue via ZecOps here.