Sources: US firm Accuvant, now part of Optiv, sold iPhone hacking tool Karma to the UAE for $1.3M in 2016; the tool has been used against hundreds of targets
Patrick Howell O'Neill / MIT Technology Review :
Context & Ripple Effects
The 2019 report that the UAE used Karma against activists, diplomats and foreign leaders identified the tool’s operational use; this account ties that campaign to a previously reported UAE iPhone-hacking operation and names the U.S. supplier behind it.
The disclosure sits alongside reporting that an iPhone zero-day was used to target Uyghurs and that NSO marketed access extending from compromised phones into cloud accounts. Together, the coverage shows iPhone exploitation as a commercial capability supplied across multiple national security customers.
First-order effects
- Accuvant, now part of Optiv, is directly linked to the 2016 sale of Karma to the UAE, while the report attributes the tool’s use to hundreds of targets.
- The UAE’s earlier Karma operation gains a documented commercial provenance rather than appearing solely as a state-run hacking campaign.
Second-order effects
- Apple faces another example of iPhone vulnerabilities being converted into state surveillance tools, alongside the reported use of another iPhone zero-day against Uyghurs.
- Offensive-tool vendors such as NSO compete in a market where buyers seek not only device access but, as NSO claimed, the ability to extract authentication keys for cloud services.
Third-order effects
- The reporting points to a broader supply chain for state surveillance in which U.S., Israeli and Chinese-linked research capabilities can reach government customers, making vendor provenance as consequential as the exploit itself.
- As mobile compromise is paired with cloud-session access, the commercial spyware market’s strategic value shifts from single-device intrusion toward persistent access to a victim’s wider digital accounts.
The trend: Commercial iPhone exploitation is evolving from a discrete vulnerability trade into an international surveillance supply chain that combines device access with account-level access.