“While analyzing the phone of a Saudi activist infected with NSO Group’s Pegasus spyware, we discovered a zero-day zero-click exploit against iMessage.”
A file named .gif arrives in iMessage. It hits an integer overflow in Apple’s image rendering library, and the phone belongs to NSO. The target never taps anything. Citizen Lab found it in a Saudi activist’s backup and Apple confirmed it six days later. Apple sells privacy. A university lab is doing the threat hunting.