Privacy Ninja



        • Secure your network against various threat points. VA starts at only S$1,000, while VAPT starts at S$4,000. With Price Beat Guarantee!

        • API Penetration Testing
        • Enhance your digital security posture with our approach that identifies and addresses vulnerabilities within your API framework, ensuring robust protection against cyber threats targeting your digital interfaces.

        • On-Prem & Cloud Network Penetration Testing
        • Boost your network’s resilience with our assessment that uncovers security gaps, so you can strengthen your defences against sophisticated cyber threats targeting your network

        • Web Penetration Testing
        • Fortify your web presence with our specialised web app penetration testing service, designed to uncover and address vulnerabilities, ensuring your website stands resilient against online threats

        • Mobile Penetration Testing
        • Strengthen your mobile ecosystem’s resilience with our in-depth penetration testing service. From applications to underlying systems, we meticulously probe for vulnerabilities

        • Cyber Hygiene Training
        • Empower your team with essential cybersecurity knowledge, covering the latest vulnerabilities, best practices, and proactive defence strategies

        • Thick Client Penetration Testing
        • Elevate your application’s security with our thorough thick client penetration testing service. From standalone desktop applications to complex client-server systems, we meticulously probe for vulnerabilities to fortify your software against potential cyber threats.

        • Source Code Review
        • Ensure the integrity and security of your codebase with our comprehensive service, meticulously analysing code quality, identifying vulnerabilities, and optimising performance for various types of applications, scripts, plugins, and more

        • Email Spoofing Prevention
        • Check if your organisation’s email is vulnerable to hackers and put a stop to it. Receive your free test today!

        • Email Phishing Excercise
        • Strengthen your defense against email threats via simulated attacks that test and educate your team on spotting malicious emails, reducing breach risks and boosting security.

        • Cyber Essentials Bundle
        • Equip your organisation with essential cyber protection through our packages, featuring quarterly breached accounts monitoring, email phishing campaigns, cyber hygiene training, and more. LAUNCHING SOON.

iPhones running latest iOS hacked to deploy NSO Group spyware

iPhones running latest iOS hacked to deploy NSO Group spyware

Human rights non-governmental organization Amnesty International and non-profit project Forbidden Stories revealed in a recent report that they found spyware made by Israeli surveillance firm NSO Group deployed on iPhones running Apple’s latest iOS release, hacked using zero-day zero-click iMessage exploits.

“Amnesty International has observed evidence of compromise of the iPhone XR of an Indian journalist (CODE INJRN1) running iOS 14.6 (latest available at the time of writing) as recently as 16th June 2021,” the report reads.

“Lastly, Amnesty International has confirmed an active infection of the iPhone X of an activist (CODE RWHRD1) on June 24th 2021, also running iOS 14.6.

Also Read: How Does Ransomware Work? Examples and Defense Tips

“Most recently, a successful “zero-click” attack has been observed exploiting multiple zero-days to attack a fully patched iPhone 12 running iOS 14.6 in July 2021.”

The NGO also sad that it reported this information to Apple, who said that they are investigating the matter.

“Attacks like the ones described are highly sophisticated, cost millions of dollars to develop, often have a short shelf life, and are used to target specific individuals,” Ivan Krstić, head of Apple Security Engineering and Architecture, told The Washington Post.

“While that means they are not a threat to the overwhelming majority of our users, we continue to work tirelessly to defend all our customers, and we are constantly adding new protections for their devices and data.”

Countries where journalists were targeted with spyware
Countries where journalists were targeted with spyware (Forbidden Stories)

Findings confirmed by Citizen Lab’s peer review

Bill Marczak, a research fellow at academic research lab Citizen Lab, also revealed that an independent peer review of Amnesty’s report said that the forensic methodology is sound and led to additional evidence supporting the report’s findings.

Citizen Lab was able to independently observe NSO Pegasus spyware deployed on an iPhone 12 Pro Max running iOS 14.6 (the OS’s latest release), hacked via a zero-day zero-click iMessage exploit, which does not require interaction from the target.

The researchers also discovered zero-click iMessage attacks that led to Pegasus being installed on an iPhone SE2 phone running iOS version 14.4 and an iPhone SE2 device running iOS 14.0.1.

“The mechanics of the zero-click exploit for iOS 14.x appear to be substantially different than the KISMET exploit for iOS 13.5.1 and iOS 13.7, suggesting that it is in fact a different zero-click iMessage exploit,” Citizen Lab added.

Pegasus is a spyware tool developed by NSO Group and marketed as a surveillance tool “licensed to legitimate government agencies for the sole purpose of investigating crime and terror.”

“These most recent discoveries indicate NSO Group’s customers are currently able to remotely compromise all recent iPhone models and versions of iOS,” Amnesty International and Forbidden Stories said in their report.

NSO Group spyware used in high-profile attacks

This is just one of a long string of reports and papers documenting NSO Group’s Pegasus spyware being used to spy on human rights defenders (HRDs) and journalists worldwide.

For instance, two years ago, Facebook sued Israeli cyber-surveillance firm NSO Group and its parent company for creating and selling a WhatsApp zero-day exploit. 

The zero-day exploit was later used to hack and infect the devices of high-profile targets such as government officials, diplomats, and journalists with spyware.

Researchers at Citizen Lab revealed in 2018 that they found some Pegasus licensees using it actively for cross-border surveillance and in countries with a history of abusive behavior by state security services.

In collaboration with Microsoft, Citizen Lab also reported last week that they found links between another Israeli surveillance firm known as Candiru to new Windows spyware dubbed DevilsTongue deployed on targets’ computers via now patched Windows zero-day vulnerabilities.

“Candiru is a secretive Israel-based company that sells spyware exclusively to governments,” Citizen Lab said. “Reportedly, their spyware can infect and monitor iPhones, Androids, Macs, PCs, and cloud accounts.”

Microsoft researchers discovered “at least 100 victims in Palestine, Israel, Iran, Lebanon, Yemen, Spain, United Kingdom, Turkey, Armenia, and Singapore,” with the list of victims including “politicians, human rights activists, journalists, academics, embassy workers, and political dissidents.”

Also Read: Vulnerability Assessment vs Penetration Testing: And Why You Need Both



Subscribe to our mailing list to get free tips on Data Protection and Data Privacy updates weekly!

Personal Data Protection


We have assisted numerous companies to prepare proper and accurate reports to PDPC to minimise financial penalties.


Click one of our contacts below to chat on WhatsApp

× Chat with us