A crypto wallet maker claimed this week that hackers may be targeting people with an iMessage “zero-day” exploit — but all signs point to an exaggerated threat, if not a downright scam.
Trust Wallet’s official X (previously Twitter) account wrote that “we have credible intel regarding a high-risk zero-day exploit targeting iMessage on the Dark Web.
According to Apple, there is no evidence anyone has successfully hacked someone’s Apple device while using Lockdown Mode.
For its part, CodeBreach Lab appears to be a new website with no track record.
TechCrunch could not reach CodeBreach Lab for comment because there is no way to contact the alleged company.
In its previous price list, published in 2019, the highest payouts that Crowdfense was offering were $3 million for Android and iOS zero-days.
In a report last month, Google said it saw hackers use 97 zero-day vulnerabilities in the wild in 2023.
Spyware vendors, which often work with zero-day brokers, were responsible for 75 percent of zero-days targeting Google products and Android, according to the company.
Zero-day brokers, as well as spyware companies like NSO Group and Hacking Team have often been criticized for selling its products to unsavory governments.
“All the companies and governments directly sanctioned by the USA are excluded.”At least one company, spyware consortium Intellexa, is on Crowdfense’s particular blocklist.
U.S. software giant Ivanti has confirmed that hackers are exploiting two critical-rated vulnerabilities affecting its widely-used corporate VPN appliance, but said that patches won’t be available until the end of the month.
Ivanti said the two vulnerabilities — tracked as CVE-2023-46805 and CVE-2024-21887 — were found in its Ivanti Connect Secure software.
Formerly known as Pulse Connect Secure, this is a remote access VPN solution that enables remote and mobile users to access corporate resources over the internet.
When TechCrunch asked why patches weren’t being made available immediately, Ivanti declined to comment.
Ivanti is urging that potentially impacted organizations prioritize following its mitigation guidance, and U.S. cybersecurity agency CISA has also published an advisory urging Ivanti Connect Secure to mitigate the two vulnerabilities immediately.
