Apple has pushed out an essential security update to defend against yet another attack by an out-of-control mercenary surveillance group.

Like a bad smell, NSO Group has clawed its way back into the spotlight with yet another unprincipled attack against free speech and citizens' rights, as revealed by Citizen Lab. The security researchers found this latest example of a sinister, yet egregious zero-click attack while checking the device of an “Individual employed by a Washington DC-based civil society organization with international offices.”

This attack, which is being used to deliver NSO Group’s Pegasus mercenary spyware, is deeply concerning as it can compromise iPhones running iOS 16.6 without requiring any interaction from the victim. The researchers explained the exploit involved PassKit attachments containing malicious images sent via iMessage. The victim wasn’t even required to look at this image.

Citizen Lab alerted Apple to the attack and the company swiftly published a security update for all its devices to protect against it. Both companies confirm Lockdown Mode will secure devices against such attack.

Apple published support notes detailing the content of the latest security updates. Warning that these attacks may already be actively exploited, these reveal that “processing a maliciously crafted image may lead to arbitrary code execution,” and that this attack was also viable against Wallet.

“We would like to acknowledge The Citizen Lab at The University of Torontoʼs Munk School for their assistance,” Apple said.

“In this critical time for the future of democracy, the out-of-control mercenary spyware industry is directly undermining our core shared values, security and human rights,” Citizen Labs Senior Researcher John Scott-Railton warned the US House Intelligence Committee last July.

“Once more, civil society, is serving as the cybersecurity early warning system for...billions of devices around the world,” he subsequently warned on the latest attack.

These attacks are proliferating, the number of companies launching them is increasing, and researchers believe it is inevitable these dangerous exploits will eventually be used by criminals, threatening every aspect of civil society.

There is a security war that must be fought. Apple has already patched 13 actively exploited zero-day vulnerabilities so far this year. The time for complacency with Apple security is gone.

With this in mind, it’s important to adopt a less casual stance to device security.

The mercenaries who create and profit from these attacks like to claim they only work for legitimate governments. If that’s the case, it is strange that civil society advocates across the planet are regularly being targeted.

In other words, far from being found in action against a criminal or military target, this particular attack was being made against someone fighting for civil rights in some way. That is not at all reassuring.

Particularly in light of a recent investigation by the Polish government, which found “gross violations of constitutional standards” when the NSO Group’s Pegasus surveillance software was used against opposition leaders. These clearly aren’t the good guys they pretend to be.

In general, such attacks are described as being more likely to take place against high-value targets, as they can be costly to mount. But it is inevitable that attacks of this kind will proliferate and enter the realm of mainstream digital criminality.

It is essential this egregious and amoral sham “industry” is bought to heel.

Please follow me on Mastodon, or join me in the AppleHolic’s bar & grill and Apple Discussions groups on MeWe.