Pegasus Spyware Invades iPhones and Blackmails Victims

Pegasus Spyware is being used in a new extortion scam that seeks to blackmail iOS users. The data collected by Pegasus Spyware is used to scare victims into paying so that the data is not released. A month ago, Amnesty International disclosed that Pegasus spyware was installed on fully updated iPhones through a zero-day zero-click iMessage vulnerability.

A zero-click vulnerability is a hack that is performed without any interaction by the user. These are extremely dangerous and high-priority issues for teams once they are discovered.

Amnesty believes that Pegasus Spyware is used by governments to monitor the communication of politicians, journalists, human rights activists, and business executives worldwide.

This week, a threat actor has been emailing iOS users informing them their devices was compromised with a ‘zero-click’ vulnerability to install the Pegasus spyware software.

The scammer explains that Pegasus Spyware has been used to monitor the victim’s activities and that they have created videos of them during “the most private moments” of their lives.

The email warns that if a 0.035 bitcoin (approximately $1,600) payment is not paid, the threat actors will send the videos to the recipient’s family, friends, and business associates.

The full text of the email is as follows:

You can read the full text of this email below:

“Hi there
Hello, I’m going to share important information with you.

Have you heard about Pegasus? You have become a collateral victim. It’s very important that you read the information below.

Your phone was penetrated with a “zero-click” attack, meaning you didn’t even need to click on a malicious link for your phone to be infected. Pegasus is a malware that infects iPhones and Android devices and enables operators of the tool to extract messages, photos and emails, record calls and secretly activate cameras or microphones, and read the contents of encrypted messaging apps such as WhatsApp, Facebook, Telegram and Signal.

Basically, it can spy on every aspect of your life. That’s precisely what it did. I am a blackhat hacker and do this for a living. Unfortunately you are my victim. Please read on.

As you understand, I have used the malware capabilities to spy on you and harvested datas of your private life. My only goal is to make money and I have perfect leverage for this.

As you can imagine in your worst dream, I have videos of you exposed during the most private moments of your life, when you are not expecting it.

I personally have no interest in them, but there are public websites that have perverts loving that content.
As I said, I only do this to make money and not trying to destroy your life. But if necessary, I will publish the videos. If this is not enough for you, I will make sure your contacts, friends, business associates and everybody you know see those videos as well.

Here is the deal. I will delete the files after I receive 0.035 Bitcoin (about 1600 US Dollars). You need to send that amount here [Wallet Address]

I will also clear your device from malware, and you keep living your life. Otherwise, sh*t will happen. The fee is non negotiable, to be transferred within 2 business days.

Obviously do not try to ask for any help from anybody unless you want your privacy to be violated. I will monitor your every move until I get paid. If you keep your end of the agreement, you won’t hear from me ever again.

Take care.”

Fortunately, there are currently no payments to the wallet address contained in the email. It is possible that other emails may have different addresses which have been paid.

While it is most likely this truly is a scam – That is to say, that the targets don’t have Pegasus Spyware installed – these types of activities have proven lucrative. Similar scams have generated thousands of dollars for the hackers behind them.

Though these types of emails can elicit fear in people, it is always best to mark them as scams and delete the email, as they are rarely truthful.

Pegasus Spyware Analysis

Note: This Analysis was carried out by LookOut.

The attack is very simple in its delivery and silent in delivering its payload. The attack starts when the attacker sends a website URL (through SMS, email, social media, or any other message) to an identified target. The user only has to take one action–click on the link. Once the user clicks the link, the software silently carries out a series of exploits against the victim’s device to remotely jailbreak it so that the espionage software packages can be installed.

The user’s only indication that anything happened will be that the browser closes after the link is clicked. The espionage software contains malicious code, processes, and apps that are used to spy, collect data, and report back what the user does on the device. Pegasus spyware can access and exfiltrate messages, calls, emails, logs, and more from apps including, but not limited to: