Hackers use n-day exploits in zero-click attacks on iOS, Android devices

What happened

Attackers have compromised the update infrastructure for the cPGuard web security suite, hijacking its autoupdate mechanism to distribute a backdoor and a data-stealing script to unsuspecting users. The incident highlights how threat actors are increasingly targeting the supply chain by compromising trusted software update channels.

Why this matters

Supply chain attacks are particularly dangerous because they exploit trust. When security tools themselves are weaponized, organisations often have fewer reason to question their legitimacy. The distribution of malicious updates through a compromised autoupdate system means that even well-intentioned organisations could have been impacted without realising it.

Key risks

• Backdoor access: Compromised updates can provide persistent remote access to affected systems.
• Data exfiltration: The deployment of data-stealing scripts puts sensitive information at risk.
• Widespread impact: Any organisation using cPGuard with autoupdates enabled could have received the malicious payload.
• Trust erosion: Incidents like this undermine confidence in automated update mechanisms.

What should organisations do now

• Check for compromise: Review cPGuard installations, logs, and network activity for signs of backdoor communication or data exfiltration.
• Verify updates: Only apply updates from verified sources. If in doubt, download directly from the vendor’s official channels.
• Hunt for indicators: Look for unusual outbound connections, unexpected processes, or modifications to security tool configurations.
• Apply defence in depth: Ensure endpoint detection and response (EDR), network monitoring, and strict egress controls are in place.
• Review access: Assume credentials on affected systems may have been exposed and rotate them as a precaution.

BTInfosec perspective

At BTInfosec, we consistently advise organisations to treat software supply chains as high-risk attack surfaces. Our Vulnerability Management and Assurance & Testing services help identify these risks before they become incidents. For organisations needing a broader security programme, our managed services provide continuous monitoring and rapid response to threats like this.

Source: https://www.bleepingcomputer.com/news/security/hackers-use-n-day-exploits-in-zero-click-attacks-on-ios-android-devices/