Mobile Malware · Real-World Cases · Lesson 3 of 5

Pegasus & Zero-Click Exploits

Inside two documented iMessage chains, the lawsuits, and why patches help everyone.

How a zero-click chain is built

In iOS Internals you learned that Pegasus is mercenary spyware sold by NSO Group, and that its worst versions need no tap at all. This lesson looks at what researchers actually found inside two of those attacks.

Why messaging apps? To show a preview or thumbnail, a phone must open and decode whatever a stranger sends, before you decide anything. That decoding code is complicated, handles dozens of file formats, and runs automatically. That makes it the best place to hunt for a bug that needs no help from the victim. Apple added a sandbox called BlastDoor in iOS 14 to process untrusted iMessage content in a locked-down space.

One bug is rarely enough. Attackers use an exploit chain: several vulnerabilities used one after another, each doing one job, such as getting code running inside a parser, escaping the sandbox, then gaining deeper control so the spyware can be installed. Each step is a separate flaw that defenders can find and fix.

FORCEDENTRY (2021): Citizen Lab shared a captured sample with Google Project Zero, whose December 2021 analysis called it "one of the most technically sophisticated exploits we've ever seen." The attack sent a file named like a GIF that was really a PDF. iMessage decided how to handle it by its content, not its name, so a PDF parser in Apple's CoreGraphics opened it, and that processing happened outside BlastDoor. Apple fixed the bug (CVE-2021-30860) in iOS 14.8 on September 13, 2021, then narrowed which formats that path would accept in later releases.

BLASTPASS (2023): Citizen Lab found it on the iPhone of someone at a Washington, DC based civil society organization. It used PassKit attachments (the format behind Wallet passes) containing malicious images, sent from an attacker's iMessage account. Apple fixed two bugs, one in the Image I/O image framework (CVE-2023-41064) and one in Wallet (CVE-2023-41061), in iOS 16.6.1 on September 7, 2023, with matching fixes for iPad, Mac and Apple Watch.

Lawsuits and why patches matter

Spyware cases are usually investigated by researchers, but two companies also took NSO Group to court.

WhatsApp v. NSO. In May 2019, WhatsApp found and fixed a flaw in its calling feature that attackers had used to send spyware to phones. WhatsApp said about 1,400 users were targeted, and in October 2019 it sued NSO in US federal court in California. After years of litigation, a jury in May 2025 awarded WhatsApp about $444,000 in compensatory damages and about $167 million in punitive damages. In October 2025, Judge Phyllis Hamilton cut the punitive award to $4 million but issued a permanent injunction barring NSO from targeting WhatsApp. NSO said the injunction doesn't reach its customers, and reports indicate the case moved to appeal, so the final outcome may still change.

Apple v. NSO. Apple sued NSO in November 2021, the same month the US Commerce Department added NSO to its Entity List, which restricts US exports to listed companies. In September 2024, Apple asked the court to dismiss its own case. Apple said sharing its threat intelligence during the case, even under court protections, could help NSO and other spyware makers.

Notice what happened next in each technical case: a patch. That's why this matters for people who will never be targeted. FORCEDENTRY and BLASTPASS were aimed at a few people, but the bugs existed on every iPhone running those versions. Once Citizen Lab shared what it found and Apple shipped the fix, the hole closed for every device that updated. Apple says chains like these cost millions of dollars, so a patch also destroys an expensive tool.

Unpatched phones stay exposed. After a fix ships, details tend to spread, and less careful attackers may try the same bug on people who never updated. The realistic risk for most people is low, and the defense is the same for everyone: install updates promptly.