“The exploit chain was capable of compromising iPhones running the latest version of iOS (16.6) without any interaction from the victim.”
The target worked at a civil society group in Washington DC. The delivery vehicle was a PassKit attachment with a malicious image, sent over iMessage. Apple shipped two CVEs after Citizen Lab found the chain on one phone. NSO’s mercenary spyware beat the latest iOS, and a civil society lab caught it before Apple did.