Sources: Android and Windows have also been targeted by the websites that sought to infect iPhones of Uighur ethnic minority in China
The unprecedented attack on AppleiPhones revealed by Google this week was broader than first thought. Multiple sources with knowledge of the situation …
ForbesThomas Brewster
Context & Ripple Effects
Google's disclosure of malicious websites that hacked iPhones over two years was framed as an iOS story; this report widens it. Sources say the same infrastructure also sought to infect Android and Windows machines, meaning the operation targeted a community rather than a platform.
That reading fits the arc of subsequent reporting: researchers later found China's mobile hacking campaign against the Uighurs ran broader and longer than first known, and Chinese hackers separately compromised telecom operators abroad to track Uighur travelers.
First-order effects
Android and Windows users within or adjacent to the Uighur community faced the same watering-hole exposure as iPhone owners, expanding the population that needed emergency patching beyond Apple's customer base.
Apple's fix no longer closes out the incident: Google and Microsoft inherit active exploitation of their platforms by the same operator.
Second-order effects
Cross-platform targeting forces Google, Microsoft, and Apple to coordinate disclosure and patch timing rather than treating each vendor's zero-day as an isolated event.
Security teams can no longer scope risk by device fleet alone — organizations serving diaspora communities must assume any OS their members use is in the target set.
Third-order effects
If state-backed operators build parallel exploit chains for every major OS, device choice stops being a meaningful defense and vendor threat notifications — like Apple's later warnings to Indian opposition figures — become the primary alert channel for targeted individuals.
Surveillance operations structured around people rather than platforms push the industry toward treating cross-platform attack infrastructure as the baseline planning assumption, with attribution pressure shifting to governments.
The trend: State-sponsored mobile espionage is converging on person-level targeting with parallel exploit chains across iOS, Android, and Windows, making vendor-issued threat notifications the last line of defense for targeted users.
Google blog post didn't say how they found the infected website(s) using the iOS zero-days. But I'm sitting here thinking, again, that after $127B in annual InfoSec spending, it was an advertising platform that found it... and not a security vendor. Threat intel or otherwise.
And now @forbes reports: “Google's and Microsoft's operating systems were targeted via the same websites that launched the iPhone hacks, according to the sources, who spoke on the condition of anonymity.” Project Zero lacked so much context it became a social attack itself. https…
Timeline: - Google's Project Zero blogs legit iOS exploit but with no context. - Story gets re-blogged, people get panicked. - TechCrunch finds out it was targeted at the Uyghur community in Xinjiang, China. - Forbes finds out it targeted Android and Windows too. WTF PZ? https://…
If CCP is using redirected “watering holes” to upload malware into Uighur phones for iOS, Android & Windows, it is likely that CCP will redirect HK'ers to HK-centric watering holes. Forbes https://www.forbes.com/... TechCrunch https://www.forbes.com/...
So the iOS hacking campaign revealed last week affected Android and Windows devices as well — but somehow, the coverage induced by Google's announcement only touched on the iOS bit. Odd. (h/t @jkohlmann, @zackwhittaker) https://www.forbes.com/...
Implant Teardown The implant has access to all the database files (on the victim's phone) used by popular end-to-end encryption apps like Whatsapp, Telegram and iMessage. https://googleprojectzero.blogspot.com/ ...
You were very likely not hacked by this. The infected websites received very little traffic, Google said. The news is mostly significant because of how rare iOS zero-days are and because this campaign was indiscriminate, not targeted, raising questions about who did it and why.
Many things to learn from this incident, but one is the safety cost of anti-competitive iOS App Store policies. Chrome/Brave/Firefox are required to use the default WebKit/JS. If Apple isn't going to put in the work necessary to protect users then they should let others do so. ht…
A dig from a Googler about Apple's ostensibly security-minded (in part) reason for allowing only its own browser engine on iOS & iPadOS. (Chrome, Firefox, etc. are available on iOS, but unlike on MacOS, Windows, Android, are required to use Apple's WebKit browser engine.) https:/…
I'm trying to decide if learning of indiscriminate iOS zero day attacks in the wild is just incredibly concerning, or the biggest iOS security news since the launch of the platform: https://googleprojectzero.blogspot.com/ ...
Terrific drill-down on a web-based iOS exploit chain. But, I can't find any info on what kind of sites were being used? If they were a tiny cluster in a remote region vs. major multinational, it's a very different threat level. https://googleprojectzero.blogspot.com/ ...
The implant was used to steal location data and files like databases of WhatsApp, Telegram, iMessage. So all the user messages, or emails. Copies of contacts, photos, https://googleprojectzero.blogspot.com/ ... https://twitter.com/...
There's a lot to say about the iPhone watering hole attacks, but if you work with vulnerable groups in China this, and the fact that P0 talked about “entire populations”, means should you take extra notice of what happened https://googleprojectzero.blogspot.com/ ... https://googl…
All I am going to say about the iOS exploit chains write up by Project Zero is: “Bloody Hell!”. In the most profound British understatement tone I can muster. https://googleprojectzero.blogspot.com/ ...
Wow. This Project Zero discovery is insane. Some unnamed entity (obviously a government) had 7 Safari 0-days that have been quietly compromising iPhones for years — all the way back to iOS 10. Anyone who visited these unnamed sites were sunk. https://googleprojectzero.blogspot.co…
This is wild. A group were using hacked websites to indiscriminately exploit iPhones using zero days exploits, and somehow went unnoticed for years. https://googleprojectzero.blogspot.com/ ...
Google's Threat Analysis Group found hacked sites being used in watering hole attacks using five distinct iPhone 0-day exploit chains. The websites had thousands of visitors per week. Project Zero's analysis starts here: https://googleprojectzero.blogspot.com/ ...