Google’s Threat Analysis Group (TAG) published a report regarding RCS Labs’ activity involving infecting Android and iOS users with commercial surveillance tools. RCS Labs is an Italian spyware company that leveraged Internet service providers (ISPs) to infect users located in Italy and Kazakhstan. The observed campaigns originated with unique links sent to the targets via SMS that rendered a page prompting the user to download and install a malicious application on their Android or iOS device. The SMS message typically included a prompt regarding mobile connectivity issues. Researchers noted the reason behind this specific verbiage may be because “the actors worked with the target’s ISP to disable the target’s mobile data connectivity.” The malicious applications were typically disguised as a mobile carrier application or messaging applications, which would be endorsed through “a made-up support page that claimed to help the potential victims recover their Facebook, Instagram, or WhatsApp suspended accounts.” The fraudulent applications were not available in the Google Play or the Apple App Store, and each device type has its own attack method. The iOS application is signed with a certificate from “3-1 Mobile SRL” (a company enrolled in the Apple Developer Enterprise Program) which satisfies all iOS code signing requirements. The app contains a privilege escalation exploit wrapper that is utilized by six (6) exploits: CVE-2018-4344, CVE-2019-8605, CVE-2020-3837, CVE-2020-9907, CVE-2021-30883 (a zero-day vulnerability), and CVE-2021-30983 (another zero-day vulnerability). The app also contained a “minimalist agent capable of exfiltrating interesting files from the device, such as the Whatsapp database.” The Android Package Kit (APK) requires the target to have enabled installation of applications from unknown sources and disguises itself as a legitimate Samsung app through its icon. Once the app is launched, it requests various sensitive permissions on the device. The APK does not contain exploits but does have code that suggests exploits could be downloaded and executed if need be. There is also the ability to fetch and run remote modules present that can communicate a range of events to the main application. Google researchers emphasized that “the commercial spyware industry is thriving and growing at a significant rate”, in which all Internet users should be concerned and vigilant. An in-depth analysis of recent spyware activity as well as indicators of compromise (IOCs) can be reviewed in Google TAG’s report linked below.