We review vendors based on rigorous testing and research but also take into account your feedback and our affiliate commission with providers. Some providers are owned by our parent company.
Learn more
vpnMentor was established in 2014 as an independent site reviewing VPN services and covering privacy-related stories. Today, our team of hundreds of cybersecurity researchers, writers, and editors continues to help readers fight for their online freedom in partnership with Kape Technologies PLC, which also owns the following products: ExpressVPN, CyberGhost, and Private Internet Access which may be ranked and reviewed on this website. The reviews published on vpnMentor are believed to be accurate as of the date of each article, and written according to our strict reviewing standards that prioritize the independent, professional and honest examination of the reviewer, taking into account the technical capabilities and qualities of the product together with its commercial value for users. The rankings and reviews we publish may also take into consideration the common ownership mentioned above, and affiliate commissions we earn for purchases through links on our website. We do not review all VPN providers and information is believed to be accurate as of the date of each article.
Advertising Disclosure

vpnMentor was established in 2014 as an independent site reviewing VPN services and covering privacy-related stories. Today, our team of hundreds of cybersecurity researchers, writers, and editors continues to help readers fight for their online freedom in partnership with Kape Technologies PLC, which also owns the following products: ExpressVPN, CyberGhost, and Private Internet Access which may be ranked and reviewed on this website. The reviews published on vpnMentor are believed to be accurate as of the date of each article, and written according to our strict reviewing standards that prioritize the independent, professional and honest examination of the reviewer, taking into account the technical capabilities and qualities of the product together with its commercial value for users. The rankings and reviews we publish may also take into consideration the common ownership mentioned above, and affiliate commissions we earn for purchases through links on our website. We do not review all VPN providers and information is believed to be accurate as of the date of each article.

Spy Firm QuaDream Used Hidden Calendar Invites to Hack iPhone Victims

Spy Firm QuaDream Used Hidden Calendar Invites to Hack iPhone Victims
Zane Kennedy Published on 18th April 2023 Cybersecurity Researcher

Spyware from Israeli cyber mercenary company QuaDream has been used to target journalists, political opposition figures, and advocacy organizations in North America, Europe, Asia, and the Middle East, according to research published by Microsoft and internet watchdog Citizen Lab. The spyware was deployed via malicious calendar invites sent to the victims.

The two reports published on April 11th state that the cyber mercenary company's hacking tools, known as REIGN, were reportedly used to exfiltrate huge amounts of data from iPhones of targeted individuals.

The spyware secretly records phone calls, records audio using the phone's microphone, takes pictures, steals files, tracks the person's granular location, and deletes forensic traces of its existence, among other functionalities.

Microsoft stated that it has linked threat group DEV-0196 to QuaDream, an Israel-based private sector offensive actor that sells the REIGN platform to governments for law enforcement purposes. The platform includes malware, exploits, and infrastructure to extract data from iOS devices.

Citizen Labs said in its report that it identified traces of “a suspected iOS 14 zero-click exploit used to deploy QuaDream’s spyware. The exploit was deployed as a zero-day against iOS versions 14.4 and 14.4.2, and possibly other versions. The suspected exploit, which we call ENDOFDAYS, appears to make use of invisible iCloud calendar invitations sent from the spyware’s operator to victims.”

The government hackers who were equipped with QuaDream's exploit used malicious iCloud calendar invites with dates in the past to deliver the spyware. Those invites didn't trigger a notification on the phone, making them invisible to the target.

QuaDream's customers operate servers from countries worldwide, including Bulgaria, Czech Republic, Hungary, Romania, Ghana, Israel, Mexico, Singapore, United Arab Emirates (UAE), and Uzbekistan according to Citizen Lab, who has allegedly managed to identify and trace servers linked with QuaDream.

A spokesperson for Apple, Scott Radcliffe, said that there's no evidence showing the exploit discovered by Microsoft and Citizen Lab has been used since March 2021, when the company supposedly fixed the exploited vulnerability with an update.

QuaDream has previously made headlines for its controversial spyware activities. In February 2022, Reuters reported that the company had utilized the FORCEDENTRY zero-click exploit in iMessage to launch its REIGN spyware. More recently, in December 2022, Meta disclosed that it had dismantled a network of 250 fake accounts on Facebook and Instagram that were under the control of QuaDream.

About the Author

Zane is a Cybersecurity Researcher and Writer at vpnMentor. His extensive experience in the tech and cybersecurity industries provides readers with accurate and trustworthy news stories and articles. He aims to help individuals protect themselves through informative content and awareness of cybersecurity's crucial role in today's digital landscape.