Spyware.

Spyware operates covertly, gathering data such as browsing history, credentials, location, keystrokes, screenshots, microphone or camera feeds, and instant messages, then transmitting them to an attacker-controlled server. It ranges from grey-area adware-style trackers to highly targeted commercial implants used against journalists, dissidents and executives.

The most consequential modern spyware is delivered by "zero-click" exploit chains that need no victim interaction. Citizen Lab's 2021 discovery of NSO Group's Pegasus revealed FORCEDENTRY (CVE-2021-30860), a maliciously crafted PDF disguised as a GIF that triggered an integer overflow in Apple's CoreGraphics JBIG2 decoder, bypassing the BlastDoor sandbox — Apple patched it in iOS 14.8 on 13 September 2021. The Amnesty International-led Pegasus Project documented targeting of thousands of activists and officials. Comparable mercenary tools include Predator (Cytrox/Intellexa) and FinFisher (FinSpy), while consumer stalkerware is often installed by an abuser with brief physical access.

flowchart LR
  A[Delivery: malicious app,<br/>zero-click exploit, link] --> B[Install covert implant]
  B --> C[Escalate & evade<br/>sandbox / detection]
  C --> D[Collect: keystrokes, mic,<br/>camera, messages, location]
  D --> E[Exfiltrate to C2 server]
  E --> F[Operator surveillance]

Defences include verified app stores, mobile EDR/MDM, prompt OS and browser updates, Apple Lockdown Mode, restrictive permissions, encrypted communications, and periodic device-integrity checks.