iVerify recently published a detailed technical analysis uncovering a new iMessage vulnerability — dubbed “NICKNAME” — that could be used in a zero-click attack to compromise iOS devices. The exploit abuses the way iOS handles iMessage contact profile updates (nicknames) to trigger memory corruption and potentially deliver spyware without any user interaction.

What We Know About the Exploit

The vulnerability affects the “imagent” process which handles incoming iMessage traffic. Attackers exploit a race condition in how the system processes “Nickname Updates.” These updates rely on mutable dictionaries in Objective C and in certain conditions, can be accessed or modified by different threads at the same time. That creates a Use-After-Free memory corruption bug that can be used in advanced exploits.

After reviewing the technical details in the  iVerify report about the “NICKNAME” exploit, I find the analysis and conclusions credible and consistent with what NowSecure experts have observed over nearly a decade of mobile zero-click attacks.

The crash pattern identified in ‘NICKNAME’ shares clear similarities with prior zero-click attacks such as Trident (2016), ForcedEntry (2021), BLASTPASS (2023) and others attributed to surveillance vendors like NSO Group and Paragon. These all have been linked to commercial spyware operations and nation-state actors that leverage memory-based vulnerabilities in system-level software to install spyware to monitor the target.

What is especially alarming is the geopolitical shift in targeting. While attacks focused primarily on dissidents and journalists overseas, this one was used on United States soil against:

• A U.S. political campaign
• A media outlet
• An AI technology company
• At least one EU government official, who later received an Apple Threat Notification.

This is a major escalation. It signals that adversaries — likely nation-state backed — are extending mobile spyware operations into the U.S. and allied countries to undermine national and economic security. The attack warrants increased scrutiny and response from U.S.-based institutions.

This signals that adversaries likely nation-state backed are extending mobile spyware operations into the U.S. and allied countries to undermine national and economic security.

Are U.S. Organizations Ready?

Bluntly put: no. 

Most U.S. organizations are not equipped to detect or defend against these type of sophisticated mobile attacks. Unlike traditional computing environments, mobile operating systems restrict the visibility and tooling available to defenders: 

• There’s no admin-level access for EDR/XDR tools
• Forensics often rely on crash logs attacker can delete
• Platform-level restrictions severely limit security monitoring and threat hunting.

This leaves defenders blind even as attackers operate with near impunity. Organizations often assume that mobile platforms and app stores are secure by default, but this assumption is incorrect and increasingly dangerous.

Mobile App Risk Management: Strategies to Safeguard Revenue and Reputation

Read More

How Organizations Can Respond

Defending against zero-click mobile threats like NICKNAME requires a shift in mindset and investment. Here’s what organizations should focus on: 

1. Secure Networks – While telecom providers invest heavily in securing their infrastructure, additional layers of protection are essential. Enterprises should enforce the use of encrypted VPNs and other security controls to safeguard traffic. Individual users should avoid connecting to untrusted public Wi-Fi networks, especially in places like hotels or coffee shops, and instead rely on trusted networks or their carrier’s mobile network whenever possible.
2. Secure Devices & Operating Systems – Although no system is entirely immune to attack, the most resilient mobile environments for U.S. organizations are those built by U.S.-based vendors that control both the hardware and the operating system—namely Apple (iPhone/iOS) and Google (Pixel/Android). These companies are uniquely positioned to manage the full device lifecycle, respond rapidly to discovered vulnerabilities, and are subject to U.S. laws and enforcement. 

   Just as important, organizations must apply security updates promptly to patch zero-day vulnerabilities and reduce the risk of zero-click exploits. All iOS users should immediately update to iOS 18.3.1 or later because that version contains the patch for the NICKNAME vulnerability.

3. Secure Applications – Insecure mobile apps can compromise even the most secure networks and devices. While the Apple App Store and Google Play enforce basic compliance and malware screening, they do not perform thorough security or privacy testing. As a result, many apps expose users to unnecessary risk, such as transmitting sensitive data insecurely or including flawed code due to poor development practices. To mitigate these risks, mobile applications must undergo continuous, rigorous mobile application security testing to ensure they meet high standards for data protection and secure functionality.
4. Stronger Collaboration and Visibility – Today’s mobile security platform is hamstrung by limited diagnostic capabilities and restricted permissions, preventing meaningful monitoring or forensic analysis. Stronger collaboration and transparency between Apple and Google and the security research community is urgently needed to improve detection, response and overall resilience across the mobile ecosystem.

Don’t wait for more zero-click exploits to escalate before acting. Now’s the time for the security industry, platform providers and enterprises to take mobile risk seriously. Reach out to learn more about mobile app risk management approaches to strengthen defenses.

The post NowSecure Responds to ‘NICKNAME’ iMessage Exploit appeared first on NowSecure.

NowSecure