A new zero-day, zero-click Apple iMessage exploit has been identified by threat intelligence researchers at Citizen Lab. The exploit allowed deployment of the Israeli NSO Group spyware known as “Pegasus” to vulnerable iOS devices belonging to a number of high-profile Catalan individuals. The vulnerability, coined “HOMAGE,” is one of three exploits used to conduct a cyber-espionage campaign against at least sixty-five (65) members of European Parliament from Catalonia between 2017 and 2020. Pegasus spyware compromises mobile devices and is capable of eavesdropping on all communications, including encrypted messages and phone calls, collecting passwords, tracking location, turning on the device’s microphone and camera, aggregating application user data, and more. Citizen Labs did not conclusively attribute the attack to a specific threat actor but did say “a range of circumstantial evidence points to a strong nexus with one or more entities within Spanish government.” This recently identified exploit gives credit to just how sophisticated malware can be when leveraging nation state resources, and ironically enough, the only way to deploy this sophisticated spyware, is if the victim is not running the most up-to-date version of their operating system. This specific exploit was for iOS version 13.1.3 and before, so readers who have installed a software update after that version (the latest stable iOS version is 15.4) aren’t vulnerable to Pegasus. The CTIX team recommends all readers (especially those in sensitive government positions) regularly ensure that their smartphones and other mobile devices are running the most recent security infrastructure available. This is not an isolated incident, Pegasus is very popular with nation state threat actors, and the CTIX team will continue to monitor new findings concerning Pegasus spyware and NSO Group.