Another “Zero-Click” Spyware Discovered

Targeted Journalists, Political Opponents, NGO Around the World

​Now another Israeli company joins the NSO Group for its flagrant disregard for human rights, democracy, and digital privacy in the name of profit.
 
QuaDream has been identified by The Citizen Lab at the Monk School of Global Affairs and Public Policy as the developer of a new spyware, Reign. Like the more notorious Pegasus, Reign infiltrates phones without requiring the target to click on a malicious link or to even take any action at all. 
 
Citizen Lab found that Reign can:

• Record audio from phone calls
• Record audio from its microphone, capturing conversations in the vicinity of a phone.
• Take pictures through the device’s front or back camera.
• Steal passwords and other security information from an iPhone’s keychain.
• Track the device’s (and therefore, the user’s) locations and movements.
• Search files for specific content.

And when the job is complete, Reign self-destructs, removing most of the evidence that it was at ever at work in the victim’s phone.
 
For decades, iPhone users enjoyed superior security. Reign took a big bite out of Apple’s vaunted security features. It infected some victims’ phones by sending them an iCloud invitation, following up on previous invitations, which makes the fake resend invisible to the user. Meanwhile, Google has issued some software patches to address vulnerabilities with its Android smartphone.

Microsoft, which partnered with Citizen Lab, reported that the technology has been used to surveil journalists, political opposition figures, and an NGO in countries ranging from the Middle East to Central Europe and Latin America.
 
We have seen time and again that commercially developed spyware finds its most lucrative market in sales to repressive governments and the world’s most dangerous criminal enterprises. While the Israeli government seems alert now to the threat posed by the commercial spyware sector, other actors around the world are surely poised to pick up the slack. The arms race between Apple, Google, and Samsung against spyware developers will continue apace. In the meantime, as former Vice President Nelson Rockefeller said: “If you don’t want it known, don’t say it over the phone.”
 
Or anywhere within twenty feet of your smartphone.