Sources: UAE hacked iPhones of activists, diplomats, and rival foreign leaders using a spying tool called Karma, which exploited an iMessage vulnerability
WASHINGTON (Reuters) - A team of former U.S. government intelligence operatives working for the United Arab Emirates hacked …
Context & Ripple Effects
This report lands mid-arc: the NYT had already documented how the UAE uses foreign-supplied hacking tools to crack down on human rights activists, and Reuters later traced the unit's origins to White House veterans who helped build the Emirati surveillance apparatus after 9/11. What is new here is the tool itself — Karma, an iMessage exploit run by a team of former U.S. government operatives working for Abu Dhabi.
The supply chain matters as much as the targeting. Karma was reportedly sold to the UAE by U.S. firm Accuvant, now part of Optiv, for $1.3M in 2016, and went on to be used against hundreds of targets — a template that foreshadows the later wave of mercenary iPhone intrusions, including Apple's notifications to nine U.S. State Department employees hit with NSO spyware.
First-order effects
- Activists, diplomats, and rival foreign leaders whose iPhones were targeted had their messages exposed through a zero-click-style iMessage vulnerability, with no action required from the victim.
- Apple's messaging platform takes the reputational hit: a single exploit chain let one state actor reach hundreds of targets without device-specific tailoring.
Second-order effects
- U.S.-based vendors like Accuvant/Optiv face scrutiny for exporting offensive capability to Gulf clients, pressuring the nascent commercial spyware market toward tighter vetting of government buyers.
- Rival spyware merchants such as NSO compete in the same buyer pool, and each confirmed campaign — Karma's or NSO's hits on State Department staff — raises the political cost of selling to governments with poor human-rights records.
Third-order effects
- If ex-intelligence contractors keep brokering exploits to foreign security services, expect export-control regimes and platform-level hardening (Apple patching iMessage, notifying victims) to become the main checks on a spyware trade that regulation has not yet caught up with.
- The pattern points toward surveillance capability becoming a standard state procurement item, with Western firms as suppliers and activists, journalists, and diplomats as the recurring collateral targets.
The trend: Commercially brokered iPhone exploits are turning state surveillance into an off-the-shelf market, with former U.S. intelligence personnel as the bridge between Silicon Valley vulnerabilities and Gulf buyers.