Apple alerts exploit developer that his iPhone was targeted with government spyware

In a startling revelation earlier this year, a developer received a warning on his iPhone from Apple, stating, "Apple detected a targeted mercenary spyware attack against your iPhone." The individual, who chose to remain anonymous for safety reasons, expressed his shock and panic upon receiving the notification. Known as Jay Gibson, he previously worked for Trenchant, a company that creates surveillance technologies for government hacking tools. This incident marks a significant moment, as it may be the first documented case of an exploit developer being targeted with spyware. "What the hell is going on? I really didn’t know what to think of it," Gibson recounted. Following the alarming message on March 5, he immediately deactivated his phone, purchased a new one, and reached out to his father, overwhelmed by the situation. At Trenchant, Gibson specialized in discovering vulnerabilities in iOS systems, crafting tools to exploit those weaknesses, often without the knowledge of the hardware or software manufacturers. Gibson's case raises concerns about the increasing number of spyware targets. According to three sources familiar with the situation, other spyware developers have also received similar alerts from Apple in recent months. The company has yet to comment on these incidents. This incident illustrates the expanding reach of spyware and zero-day exploits, which have historically been claimed to be used solely by vetted governmental clients against criminals. Research from institutions like the University of Toronto’s Citizen Lab and Amnesty International has documented numerous cases where governments have misused such tools, targeting journalists, dissidents, and political opponents globally. Previous instances of security researchers being targeted were noted in 2021 and 2023, when North Korean hackers attacked vulnerability researchers. Just two days post-alert, Gibson reached out to a forensic expert specializing in spyware investigations. While the initial analysis showed no signs of infection on his device, the expert recommended a comprehensive forensic evaluation. However, Gibson expressed discomfort with sharing a complete backup of his phone for further analysis. The expert noted, "Recent cases are becoming more challenging to analyze, and some yield no evidence of an attack. It's possible that the spyware was not fully deployed." Without a thorough analysis, it remains unclear why Gibson was targeted or who the perpetrator might be. He suspects that the alert from Apple is related to his departure from Trenchant, where he felt he was unfairly blamed for a significant leak of internal tools. Apple issues such notifications when it has credible evidence of a mercenary spyware attack against an individual. The technology behind these attacks is often covertly embedded into devices, exploiting software vulnerabilities that can be worth millions of dollars. Usually, only law enforcement and intelligence agencies have the legal authority to deploy such spyware. A month prior to receiving the notification, Gibson was unexpectedly called into a meeting at Trenchant’s London office. During this meeting, he was informed of suspicions regarding double employment and was subsequently suspended. His work devices were seized for investigation. Following a review, Gibson was fired a few weeks later, with no clear explanation provided for the findings against him. Feeling coerced, he accepted a settlement offer without a full understanding of the allegations. Later, he learned from colleagues that Trenchant suspected him of leaking vulnerabilities in Google’s Chrome browser, despite his role being focused exclusively on iOS systems. Gibson firmly states, "I know I was a scapegoat. I wasn’t guilty. It’s very simple. I didn’t do absolutely anything other than working my ass off for them." This assertion has been corroborated by three former Trenchant employees, who also voiced concerns about the company’s handling of the situation.