A newly uncovered hacking campaign is targeting iOS and Android devices through zero-click attacks using previously patched vulnerabilities, including an iOS flaw linked to the DarkSword exploit kit.
The campaign highlights how attackers can chain older vulnerabilities to compromise devices without user interaction. Adam Boynton, Enterprise Strategy Manager at Jamf, has explained how attackers can chain older vulnerabilities together to compromise devices without using zero-days, highlighting the need for timely updates and visibility into device OS versions.
Here is his commentary: What’s interesting about this campaign is that every vulnerability in the exploit chains researchers identified had already been patched before it began. Nothing here needed a zero-day. The real shift is that packaged exploit kits now do the hard part of chaining multiple known flaws together, which makes it cheap to turn old bugs into a working attack. AI is likely to accelerate that trend by making chains easier to build and adapt, although nothing in the reporting suggests it played a part here.
That’s why visibility matters. Organizations need to know which operating system versions, and which application versions, are running across their devices. Chrome on Android was one of the targets here. When a critical security update is available, there is no good reason to delay it. On managed devices, updates can be enforced automatically with little or no effort from the user. On personal devices, staying up to date is good practice anyway, and businesses can build workflows that restrict access to company data from any device below a minimum OS version.”
I hope you’ll help support Apple World Today by becoming a patron. Almost all our income is from Patreon support and sponsored posts. Patreon pricing ranges from $2 to $10 a month. Thanks in advance for your support.
