Bitget App
Trade smarter
Buy cryptoMarketsTradeFuturesEarnSquareMore
Apple notifies exploit creator that their iPhone was attacked using state-sponsored spyware

Apple notifies exploit creator that their iPhone was attacked using state-sponsored spyware

Bitget-RWA2025/10/21 16:03
By:Bitget-RWA

Earlier this year, a developer was stunned when a notification appeared on his personal device: “Apple has identified a mercenary spyware attack targeting your iPhone.”  

“I started to panic,” said Jay Gibson, who requested anonymity due to concerns about possible repercussions, in a conversation with TechCrunch.  

Gibson, who until recently developed surveillance tools for the Western government hacking contractor Trenchant, may be the first known instance of a spyware and exploit creator becoming a target of such attacks themselves. 

“What is happening? I honestly had no idea how to process it,” Gibson recalled, explaining that he immediately powered down his phone and set it aside on March 5. “I went out and bought a replacement right away. I called my father. Everything was chaotic. It was a total disaster.”  

While at Trenchant, Gibson’s work involved discovering iOS zero-day vulnerabilities and crafting tools to exploit them—flaws that remain unknown to the manufacturer, such as Apple, of the affected devices or software.  

“I’m torn between feeling this is just sad and being extremely frightened, because once things escalate to this point, there’s no telling what could come next,” he told TechCrunch.  

However, Gibson may not be the only exploit engineer who has been targeted. Three individuals familiar with these incidents told TechCrunch that other spyware and exploit developers have also received Apple notifications in recent months, warning them of spyware targeting. 

Apple did not reply to TechCrunch’s request for comment. 

The attack on Gibson’s iPhone highlights how the spread of zero-day exploits and spyware is beginning to affect a broader range of individuals.  

Makers of spyware and zero-days have long insisted their products are used solely by authorized government clients against criminals or terrorists. Yet, over the last ten years, researchers from Citizen Lab at the University of Toronto, Amnesty International, and other groups have documented numerous cases in which governments used these tools to surveil activists, journalists, human rights advocates, and political opponents worldwide.   

The most comparable public incidents of hackers targeting security researchers occurred in 2021 and 2023, when North Korean state hackers were found to be going after vulnerability researchers. 

Suspect in leak investigation 

Two days after receiving Apple’s warning, Gibson reached out to a forensic specialist with significant experience in spyware investigations. The expert’s preliminary review of Gibson’s phone found no evidence of compromise, but still advised a more thorough forensic examination of the device.  

A comprehensive forensic review would have required Gibson to send a full backup of his device to the expert, something he was unwilling to do.  

“Lately, forensic investigations are getting more challenging, and sometimes we find nothing. It’s possible the attack didn’t fully proceed after the initial stage, but we can’t be sure,” the expert told TechCrunch. 

Without a complete forensic analysis—ideally one that uncovers traces of the spyware and its creator—it remains unclear why Gibson was targeted or who was behind it.  

Still, Gibson told TechCrunch he suspects the Apple alert is linked to the circumstances surrounding his exit from Trenchant, where he claims he was blamed for a damaging internal leak.  

Apple issues threat notifications when it has credible evidence that an individual has been targeted by mercenary spyware. Such surveillance tools are often secretly and remotely installed on a victim’s device by exploiting software vulnerabilities, which can be extremely valuable and take months to create. Typically, only law enforcement or intelligence agencies have the legal authority to use spyware, not the companies that develop it. 

Sara Banda, a representative for Trenchant’s parent company L3Harris, declined to comment when contacted by TechCrunch prior to publication.  

Roughly a month before receiving Apple’s notification, while still employed at Trenchant, Gibson said he was invited to the company’s London office for a team-building gathering.  

Upon arriving on February 3, Gibson was promptly called into a meeting room for a video conference with Peter Williams, then Trenchant’s general manager, known internally as “Doogie.” (In 2018, defense contractor L3Harris acquired Azimuth and Linchpin Labs, two zero-day startups that merged to form Trenchant.) 

Williams informed Gibson that the company suspected him of holding a second job and was therefore suspending him. All of Gibson’s work-related devices would be seized and examined as part of an internal probe into these claims. Williams could not be reached for comment. 

“I was stunned. I didn’t know how to respond because I couldn’t quite believe what I was hearing,” Gibson said, adding that a Trenchant IT staffer later went to his home to collect his company equipment.  

About two weeks later, Gibson said Williams called to inform him that, following the investigation, the company was terminating his employment and offering a settlement and payment. Gibson said Williams refused to disclose what the forensic review of his devices had revealed, and essentially told him he had no option but to accept the agreement and leave. 

Feeling he had little choice, Gibson said he agreed and signed the documents.  

Gibson told TechCrunch that he later heard from ex-colleagues that Trenchant believed he had leaked undisclosed vulnerabilities in Google’s Chrome browser—tools developed by Trenchant. However, Gibson and three former coworkers told TechCrunch he never had access to the company’s Chrome zero-days, as he was solely part of the iOS zero-day and spyware development team. According to them, Trenchant teams only have access to tools relevant to their specific platform.  

“I know I was made a scapegoat. I wasn’t at fault. It’s that straightforward,” Gibson said. “All I did was work hard for them.”  

Three former Trenchant staffers with direct knowledge independently confirmed the events surrounding Gibson’s suspension and dismissal.  

Two of these ex-employees said they were aware of the details of Gibson’s trip to London and the suspicions regarding leaks of sensitive company tools. 

All requested anonymity but believe Trenchant’s conclusion was mistaken. 

0

Disclaimer: The content of this article solely reflects the author's opinion and does not represent the platform in any capacity. This article is not intended to serve as a reference for making investment decisions.

PoolX: Earn new token airdrops
Lock your assets and earn 10%+ APR
Lock now!

You may also like

Deciphering the Rise of Hyperliquid Popularity: A Tactical Move for Investors in 2025

- Hyperliquid dominates decentralized perpetual trading in 2025 with $47B weekly volume and 70–80% market share via HyperEVM and Unit layer innovations. - Institutional adoption grows through SEC S-1 compliance, $1B DAT treasury, and partnerships with Safepal, attracting firms like Eyenovia and Sonnet BioTherapeutics . - Retail investors benefit from 40x leverage, 0.015% fees, and HLP program (11% annualized returns), though risks include HYPE token unlocks and security vulnerabilities. - Competitor Aster

Bitget-RWA2025/11/28 13:52
Deciphering the Rise of Hyperliquid Popularity: A Tactical Move for Investors in 2025

Ethereum News Update: Avail’s Nexus Bridges Liquidity Across 12 Blockchains, Tackling Fragmentation

- Avail's Nexus Mainnet launches as a cross-chain execution layer unifying liquidity across 12 blockchains including Ethereum and BNB Chain. - The intent-solver architecture automates optimal routing while aggregating liquidity from multiple chains through Avail's data availability layer. - Developers gain simplified cross-chain integration via SDKs and APIs, enabling real-time collateral pools and intent-based trading without managing bridges. - With Solana integration planned and Infinity Blocks roadmap

Bitget-RWA2025/11/28 13:34
Ethereum News Update: Avail’s Nexus Bridges Liquidity Across 12 Blockchains, Tackling Fragmentation

Ethereum News Update: Ethereum Drives Institutional Transformation with Amundi Tokenizing Major Fund

- Amundi tokenizes a money market fund on Ethereum , signaling institutional adoption of blockchain-based asset management. - Ethereum's upgrades like PeerDAS and Bhutan's $970k ETH staking highlight growing institutional trust in its infrastructure. - CoinShares' $250M Bitcoin Miners ETF and global digital ID initiatives underscore tokenization's role in modernizing finance. - Ethereum's $3,100 price resistance and technical indicators suggest potential for long-term resilience amid scaling improvements.

Bitget-RWA2025/11/28 13:20
Ethereum News Update: Ethereum Drives Institutional Transformation with Amundi Tokenizing Major Fund

Hyperliquid News Today: Hyperliquid Adopts Tidewater’s Strategy to Streamline Crypto Risk Management

- Hyperliquid introduces automated downsizing to stabilize HYPE, which dropped 52% from its peak. - Strategy mirrors Tidewater Renewables' capacity management, balancing short-term volatility with long-term stability. - Hyperliquid Strategies DAT plans $300M HYPE buybacks to inject liquidity and institutional-grade risk frameworks. - Market faces $1.89B+ liquidation risks if Bitcoin/Ethereum surge, prompting automated buffers to prevent cascading sell-offs. - Approach reflects growing DeFi adoption of algo

Bitget-RWA2025/11/28 13:20