One piece of malware recently found on an iPhone belonging to Ayman Nour, a dissident and 2005 Egyptian presidential candidate who subsequently spent three years in jail, originated with the increasingly embattled NSO Group of Israel. That company was recently blacklisted by Washington. The other was from a company called Cytrox, which also has Israeli ties. This was the first documentation of a hack by Cytrox, a little-known NSO Group rival.
The spyware was uncovered by digital sleuths at the University of Toronto’s Citizen Lab, who said two different governments hired the competing mercenaries to hack Nour’s phone. Both instances of malware were simultaneously active on the phone, investigators said after examining its logs.