iOS 16.6.1 fixes a major iPhone security vulnerability used to install Pegasus spyware

Apple has released a critical security update for iPhones to address a zero-day bug in iOS 16 that could allow spyware to be installed remotely on a device without any interaction from the iPhone owner. Citizen Lab, a spyware research group, Discovered the exploit last week Immediately notified Apple.

A zero-click zero-day exploit was used to install the NGO group’s Pegasus spyware on an iPhone owned by an employee of a Washington DC-based civil society organization. Pegasus is spyware developed by a private contractor. The spyware infects the phone and returns data including photos, messages and audio/video recordings.

Apple is now Released iOS 16.6.1 Even if iPhone owners were not targeted by spyware a few days after the exploit was discovered, it is critical to install this update. There are still plenty of teams ready to modify iOS security updates to figure out how to exploit this new vulnerability, raising the risk of widespread attacks.

Citizen Lab didn’t provide full details of the vulnerability for obvious reasons, but the exploit involves PassKit — the framework behind Apple Pay and Wallet — sending attachments loaded with malicious images sent via iMessage. “We look forward to publishing a more detailed discussion of the exploitation chain in the near future,” says Citizen Lab.

iOS vulnerabilities have consistently made headlines in recent years, especially when Apple was actively exploiting a security flaw before it was even aware of it. Apple has developed a Rapid Security Response system that can add security fixes to an iPhone without restarting the device.

Importantly, Citizen Lab says that Apple’s Lockdown Mode will protect users against this latest exploit, so if you’re at risk of being targeted by government-sponsored spyware, it’s a good idea to enable this mode.