Operation Triangulation: Zero-Click iPhone Malware

Kaspersky reports a zero-click iOS exploit in the wild, with infections traced through backup timelines generated by the mvt-ios utility. According to the report, the target device receives an iMessage with an exploit-carrying attachment, which triggers code execution without any user interaction. The code then downloads further exploits for privilege escalation and a final payload described as a fully featured APT platform, after which the initial message and exploit are deleted. The toolset does not support persistence, so devices may be reinfected after rebooting. The oldest infection traces date to 2019, the attack was ongoing as of June 2023, the most recent successfully targeted version was iOS 15.7, and no attribution had been made.