If you have an iPhone, stop what you're doing and update it to the latest operating system, iOS 9.3.5 (to do this, go to your Settings app, tap "General," and then "Software Update." Then tap "Download and Install"). Why? As Motherboard reports today, security researchers have found a new malicious program that can secretly bypass the security on your iPhone and capture almost all of your data, including all your texts, phone calls, emails, even burrowing into your Facebook and Gmail apps.
Fortunately, Apple's newest version of its free iPhone software, iOS 9.3.5, fixes the security vulnerabilities that this malware uses to attack your phone. So if you download and install it, you should be safe.
The malware, known as Pegasus and thought to be developed by an Israeli intelligence software vendor known as NSO Group, was uncovered after UAE human rights activist Ahmed Mansoor received an unsolicited text message from an unknown number last month containing a link. Clicking the link installed the malware, according to the researchers who analyzed it on a test iPhone. These researchers included members of Citizen Lab, a multidisciplinary cybersecurity and human rights group from the University of Toronto, and Lookout, a mobile security firm.
What they found was one of the most powerful and invasive pieces of mobile malware yet uncovered. As Motherboard reports:
NSO’s malware, which the company codenamed Pegasus, is designed to quietly infect an iPhone and be able to steal and intercept all data inside of it, as well as any communication going through it.
“It basically steals all the information on your phone, it intercepts every call, it intercepts every text message, it steals all the emails, the contacts, the FaceTime calls. It also basically backdoors every communications mechanism you have on the phone,” [Lookout VP of research Mike] Murray explained. “It steals all the information in the Gmail app, all the Facebook messages, all the Facebook information, your Facebook contacts, everything from Skype, WhatsApp, Viber, WeChat, Telegram—you name it.”
Who's using this malware and why? And who's affected? The answers to those questions remain murky, but the researchers followed a digital trail back to a group of hackers called Stealth Falcon, which they believe may have ties to the UAE government. They also found similar links targeting people in Kenya, and a journalist in Mexico. When the security researchers found out about the malware, they told Apple, and the company spent 10 days building an update that would fix the security holes.