An explosive report from Citizen Lab has levelled some rather drastic accusations against Saudi Arabia and the United Arab Emirates.

The report reveals that 36 journalists at Al Jazeera were targeted in a cyberattack which rather worryingly featured an exploit for iPhones running software older than iOS 14.

The attack made use of an exploit chain Citizen Lab is calling KISMET which uses Pegasus spyware from Israeli firm NSO Group. While NSO Group bills itself as a cybersecurity firm, this is not the first time it’s name has popped up alongside a cybersecurity incident.

What makes this exploit concerning is that it doesn’t require user input at all.

The malware is able to record audio, record calls, take pictures, track a device’s location and access passwords and other stored credentials on the handset.

Citizen Lab recounts the stories of two journalists who fell prey to this malware. Neither journo was aware they had been hacked although they did notice their smartphones were behaving strangely.

Analysis of one journalist’s device revealed “an unusual number of kernel panics” between January and July of this year, pointing to earlier attempts to access vulnerabilities on the device.

This is concerning for most people but for journalists at Al Jazeera, having a nation who doesn’t like what you have to say about them spying on you is downright dangerous.

As for NSO Group, while the malware is seemingly from the firm, the spyware industry is notoriously secretive and Citizen Lab feels there is a need for change.

“The abuse of NSO Group’s zero-click iMessage attack to target journalists reinforces the need for a global moratorium on the sale and transfer of surveillance technology, as called for by the U.N. Special Rapporteur on the promotion and protection of the right to freedom of opinion and expression, ‘until rigorous human rights safeguards are put in place to regulate such practices and guarantee that governments and non-State actors use the tools in legitimate ways'”, Citizen Lab writes.

The good news is that the exploit above doesn’t appear to work with iOS 14 so its advised that you update your software.

While you do that, we highly recommend giving Citizen Lab’s report a read here.