Apple patches three zero-days in macOS, iOS, iPadOS, and watchOS, exploited by the Triangulation iMessage spyware reported by Kaspersky earlier in June 2023
https://www.macrumors.com/... Twitter: Daniel Monastersky / @identidadrobada : Apple fixes software flaws behind hacks that Russia blamed on the United States - The Washington Post https://www.washingtonpost.com/ ... Will Strafach / @chronic : @lorenzofb has there been evidence that this is related to the Kaspersky claims? Lorenzo Franceschi-Bicchierai / @lorenzofb : Very interesting that Lockdown Mode apparently would have blocked the iPhone exploits used against Kaspersky. I wonder if all Kaspersky employees had Lockdown Mode enabled, given that some of them got infected, it would seem that the answer is “not all of them.” https://twitter.com/... Davey Winder / @happygeek : Rocking horse shit and hen's teeth rarity value here I reckon... https://twitter.com/... Boris Larin / @oct0xor : Today Apple released updates for CVE-2023-32434 (Kernel) and CVE-2023-32435 (WebKit) in-the-wild zero-days which were discovered by us (@kucher1n, @bzvr_ and yours truly) in the #iOSTriangulation attacks. Update your iOS/iPadOS/macOS/watchOS now! [image] Sean Kerner / @techjournalist : It's *always* a WebKit vulnerability. I can't remember an iOS or MacOS update in years that didn't include at least one XSS in WebKit. https://twitter.com/... @kaspersky : Today we share the details about the sinister payload deployed in the attack - a treacherous spyware implant branded as TriangleDB https://kas.pr/4qx4 !!! Jonathan Scott / @jonathandata1 : After calling out the @kaspersky RE team for: - Accusing the US of deploying spyware on Russia without proof - Using @AmnestyTech MVT-Tool to find “spyware/malware” They release this....👇 https://securelist.com/... Bill Marczak / @billmarczak : Wow... Kaspersky apparently managed to obtain an iOS kernel exploit from the #Triangulation attack! Just patched as CVE-2023-32434 in iOS 16.5.1. That's pretty much “as good as it gets” in terms of capturing an exploit chain. https://support.apple.com/... Kurt Baumgartner / @k_sec : we go deeper yet into OpTriangulation... https://securelist.com/... funny thing, it reminds me of a simple string xor decoder that i wrote for purple lambert research a few years ago. course, many malware families use the same obfuscation... #include <stdio.h> #include... https://twitter.com/... Bill Marczak / @billmarczak : Kaspersky has managed to capture the main component of #Triangulation's iOS spyware! The spyware has a modular architecture, so the main component doesn't seem to do much besides orchestration and comms, but definitely a fun look for malware researchers! https://securelist.com/... @tyrus_ : Given the prevalence of spyware like Pegasus etc infecting iOS devices by escaping the sandbox via crafted iOS messages this write up gives a good insight into their operations. -Dissecting TriangleDB, a Triangulation spyware implant #infosec https://securelist.com/... Tal Be'ery / @talbeerysec : 1/ #malware's final payload is probably the LEAST interesting part to analyze, as it is “just engineering” The real “juice” (vulns etc.) will be in the first stages, therefore the real news is that @kaspersky has caught them and will publish their analysis in future. https://twitter.com/... [image] Thomas Brewster / @iblametom : “The developers refer to string decryption as ‘unmunging’” https://twitter.com/... Runa Sandvik / @runasand : More details about the iOS spyware targeting employees at @kaspersky. https://twitter.com/... Patrick Wardle / @patrickwardle : ...so there is (very likely) a macOS version too 👀 https://twitter.com/... [image] Georgy Kucherin / @kucher1n : Our next blogpost on #iOSTriangulation (https://securelist.com/...) is finally out. Today we are ready to share details about the final payload used in the attack, which is a #spyware implant that we dubbed #TriangleDB @bzvr_ @2igosha [1/3] Forums: Ars OpenForum : iOS 16.5.1, macOS 13.4.1, and a slew of updates fix “actively exploited” security bugs
Context & Ripple Effects
This patch closes the vulnerabilities tied to Triangulation, a spyware operation Kaspersky reported earlier that month. It follows evidence that iPhone users had faced multiple zero-click iPhone exploit chains in 2022, underscoring that message-delivered attacks can bypass user caution.
Apple had previously issued fixes for flaws that defeated Blastdoor protections, so the cross-platform scope of this update matters: the affected attack surface extended beyond iPhone software to Apple’s wider device stack.
First-order effects
- Apple users on macOS, iOS, iPadOS, and watchOS receive patches for the three exploited zero-days, cutting off the disclosed Triangulation infection path on updated devices.
- Kaspersky’s technical reporting is translated into a vendor remediation event, while organizations with potentially targeted Apple fleets must prioritize deployment of the updates.
Second-order effects
- The incident increases pressure on Apple’s platform defenses and update adoption, particularly for high-risk users; the report’s indication that Lockdown Mode could have blocked the iPhone exploits gives that control added relevance.
- Spyware operators relying on comparable zero-click chains lose a known route and must either find replacement vulnerabilities or shift tactics, while defenders gain concrete indicators and patched versions to use in incident response.
Third-order effects
- Repeated emergency fixes for zero-click spyware point to a persistent contest between hardened mobile platforms and well-resourced exploit developers, rather than a security problem solved by any one patch.
- If independent research and vendor patches continue to expose these chains, demand should grow for verifiable technical reporting and stronger default protections for users most exposed to targeted surveillance.
The trend: This is one instance of mobile-platform security increasingly being shaped by rapid disclosure and patching of sophisticated zero-click spyware chains.