Encryption and VPNs are excellent tools that protect sensitive data in most situations. However, Pegasus has kernel level access to the device. This means the spyware sits in the path of all data, and uses “function hooking” to alter the legitimate app itself and intercept the decrypted communications.

First uncovered by Lookout and Citizen Lab in 2016, the highly advanced mobile spyware Pegasus was recently confirmed to have been used on business executives, human rights activists, journalists, academics and government officials.

With just a single tap the Pegasus attack has the capability to cause catastrophic data loss to a targeted individual or organization, completely compromising all communications from a smartphone. ISOs and CIOs should read this post to learn the top five things to do now.

Updating to the latest iOS version will unfortunately not remove or detect Trident if the device is already infected. If an attacker has already infected a device with Trident, updating to iOS 9.3.5, the latest version of iOS, will only protect against future infection. It does not remove the spyware itself or alert enterprises to infections.

MDMs can only detect known jailbreak techniques. Pegasus used advanced exploits of zero-day vulnerabilities to jailbreak the device. Now that these advanced techniques are publicly known, we have not observed any MDM technology that is currently able to detect them.