Apple patches three zero-days in macOS, iOS, iPadOS, and watchOS, exploited by the Triangulation iMessage spyware reported by Kaspersky earlier in June 2023
Apple addressed three new zero-day vulnerabilities exploited in attacks installing Triangulation spyware on iPhones via iMessage zero-click exploits.
BleepingComputerSergiu Gatlan
Context & Ripple Effects
Kaspersky’s June report connected Triangulation to zero-click iMessage exploitation, turning this patch release into a response to an identified spyware campaign rather than a routine maintenance update.
Later coverage shows the issue was part of a sustained run of emergency fixes across Apple platforms, while researchers eventually described a multi-year zero-click iMessage attack affecting iPhones, including devices used by Kaspersky employees.
First-order effects
Users of affected Apple operating systems receive fixes for three vulnerabilities used to install Triangulation spyware; devices that remain unpatched retain exposure to the reported exploit chain.
Apple must ship and support coordinated updates across macOS, iOS, iPadOS, and watchOS, while Kaspersky’s disclosure gains practical value as a trigger for remediation.
Second-order effects
Organizations with Apple fleets must prioritize deployment and verify coverage across several operating systems, rather than treating iPhone security as a standalone endpoint issue.
The patch raises the operating cost for the operators behind Triangulation: the disclosed vulnerabilities can no longer be relied on against updated devices, creating pressure to replace or adapt their access methods.
Third-order effects
Repeated emergency fixes for exploited flaws point to a more persistent market for high-value, zero-click mobile exploit chains, where disclosure, patch adoption, and attacker replacement cycles become central to device security.
If this pattern persists, Apple’s platform-security posture will be judged increasingly on the speed and breadth of cross-platform remediation, not solely on preventive protections around iMessage.
The trend: This is one instance of zero-click spyware campaigns driving faster, coordinated patch cycles across tightly integrated consumer-device ecosystems.
Today Apple released updates for CVE-2023-32434 (Kernel) and CVE-2023-32435 (WebKit) in-the-wild zero-days which were discovered by us (@kucher1n, @bzvr_ and yours truly) in the #iOSTriangulation attacks. Update your iOS/iPadOS/macOS/watchOS now! [image]
Today we share the details about the sinister payload deployed in the attack - a treacherous spyware implant branded as TriangleDB https://kas.pr/4qx4 !!!
After calling out the @kaspersky RE team for: - Accusing the US of deploying spyware on Russia without proof - Using @AmnestyTech MVT-Tool to find “spyware/malware” They release this....👇 https://securelist.com/...
It's *always* a WebKit vulnerability. I can't remember an iOS or MacOS update in years that didn't include at least one XSS in WebKit. https://twitter.com/...
Wow... Kaspersky apparently managed to obtain an iOS kernel exploit from the #Triangulation attack! Just patched as CVE-2023-32434 in iOS 16.5.1. That's pretty much “as good as it gets” in terms of capturing an exploit chain. https://support.apple.com/...
we go deeper yet into OpTriangulation... https://securelist.com/... funny thing, it reminds me of a simple string xor decoder that i wrote for purple lambert research a few years ago. course, many malware families use the same obfuscation... #include <stdio.h> #include... https:/…
Kaspersky has managed to capture the main component of #Triangulation's iOS spyware! The spyware has a modular architecture, so the main component doesn't seem to do much besides orchestration and comms, but definitely a fun look for malware researchers! https://securelist.com/..…
Given the prevalence of spyware like Pegasus etc infecting iOS devices by escaping the sandbox via crafted iOS messages this write up gives a good insight into their operations. -Dissecting TriangleDB, a Triangulation spyware implant #infosec https://securelist.com/...
1/ #malware's final payload is probably the LEAST interesting part to analyze, as it is “just engineering” The real “juice” (vulns etc.) will be in the first stages, therefore the real news is that @kaspersky has caught them and will publish their analysis in future. https://twit…
Our next blogpost on #iOSTriangulation (https://securelist.com/...) is finally out. Today we are ready to share details about the final payload used in the attack, which is a #spyware implant that we dubbed #TriangleDB @bzvr_ @2igosha [1/3]