Apple Sends Mercenary Spyware Alerts as ThreatWire Covers an npm Worm and Cyber Policy

Summary

ThreatWire reports Apple notifications warning iPhone users of targeted mercenary spyware, a self-propagating worm tied to a compromised npm package, and updates on cyber policy, a retail breach, and security changes.

Key points

Apple notified iPhone users in over 110 countries on August 13 that their phones had been targeted by mercenary spyware; the notices did not identify the spyware.
Apple cited Pegasus from the NSO Group as an example of mercenary spyware, not as confirmation that Pegasus was involved in these notifications.
The host described a presidential memorandum authorizing a program for approved companies to conduct cyber surveillance and effects operations targeting certain transnational criminal organizations.
A worm identified by Elastic Security Labs stemmed from the compromise of the key V package on npm. It sought credentials, targeted VS Code and Claude configuration files, and reportedly spread to 444 packages.
The roundup reported a data breach affecting Pokémon Centers in the UK and Germany, without providing further incident details.
Signal introduced automatic key verification using a third-party public-key ledger; Mozilla revoked and updated a GPG key after it was accidentally published to a private GitHub repository.

Article Details

Topics: [00:24] Apple threat notifications about mercenary spyware targeting iPhone users
[02:31] US memorandum authorizing cyber operations against specified transnational criminal organizations
[04:16] Shai Halud / Chain drop worm linked to a compromised npm package
[05:13] Reported Pokémon Center data breach in the UK and Germany
[05:27] Signal automatic key verification using a public-key ledger
[05:34] Mozilla revokes and updates a GPG signing key after accidental exposure
[05:43] Cursor ownership change