QuaDream's 'Reign' Spyware: Citizen Lab Disclosure and Apple's September 2023 Zero-Day Patches
In April 2023, Citizen Lab published forensic findings on 'Reign,' spyware attributed to Israeli vendor QuaDream, identifying a zero-click iPhone exploit chain used against journalists, political opposition figures, and an NGO worker. Separately, in September 2023, Citizen Lab and Apple disclosed and patched a related zero-click vulnerability chain (CVE-2023-41061 and CVE-2023-41064) exploited to deliver NSO Group's Pegasus spyware, underscoring the broader ecosystem of iOS zero-click exploitation documented that year.
Independent forensic analysis by Citizen Lab identified real-world zero-click iOS exploitation by both QuaDream's Reign spyware and a separate Pegasus exploit chain patched by Apple in September 2023 as CVE-2023-41061 and CVE-2023-41064.
How we know
Each source is linked so the finding can be checked independently. The archive's analysis below interprets these sources; it does not replace them.
On the Hunt for 'Reign' Spyware: Technical Report on a QuaDream iOS Zero-Click Exploit
Forensic lab finding· Citizen Lab· 2023-04-11Open primary sourceBLASTPASS: NSO Group iPhone Zero-Click, Zero-Day Exploit Captured in the Wild
Forensic lab finding· Citizen Lab· 2023-09-07Open primary sourceAbout the security content of iOS 16.6.1 and iPadOS 16.6.1
Vendor advisory· Apple Inc.· 2023-09-07Open primary sourceApple software is vulnerable to spyware attack through iMessage images, researchers say
News report· Reuters· 2023-09-07Open primary source
Spyphone Research Archive analysis
The section below is this archive's own interpretation of the sources above. It is not a primary document and is not attributed to any court, laboratory, or vendor.
This record documents two technically related but organizationally distinct disclosures that are frequently conflated in public discussion, and the archive's analytical contribution is to clarify that distinction for citation purposes. QuaDream's Reign spyware, detailed by Citizen Lab in April 2023, involved a separate zero-click iOS exploit chain (dubbed ENDOFDAYS) attributed to a different commercial vendor than NSO Group, while the September 2023 Apple patches for CVE-2023-41061 and CVE-2023-41064 addressed a vulnerability chain, BLASTPASS, exploited to deliver Pegasus. Treating these as a single undifferentiated 'iOS spyware event' obscures the fact that at least two competing commercial spyware vendors were independently achieving zero-click compromise of fully patched iPhones in the same calendar year.```
The archive views this concurrence as evidence of a maturing and diversifying zero-click exploit marketplace rather than an isolated vendor failure. The rapid cadence of disclosure-to-patch in the BLASTPASS case, where Apple issued emergency updates within days of Citizen Lab's referral, demonstrates that forensic collaboration between civil society labs and platform vendors has become an operational necessity for incident response, not merely an academic exercise. QuaDream's exposure, by contrast, occurred without a comparably fast platform patch tied specifically to its named exploit chain, suggesting uneven responsiveness depending on how and when vulnerabilities are referred to vendors.```
Finally, the archive cautions against over-attributing targeting outcomes solely to technical capability. Citizen Lab's reporting on QuaDream targets, including a European journalist and opposition-linked individuals, relied on device forensics and partial infrastructure correlation rather than exhaustive confirmation of client identity, meaning attribution of specific operations to specific government customers remains partially inferential. Researchers citing this case should distinguish the verified technical exploitation chain, which meets a high evidentiary bar, from the comparatively weaker evidentiary basis for identifying which state or non-state actor operated each specific implant.
Attribution
Compiled by the Spyphone Research Archive Editorial Team (RedSec LTD). Forensic identification of the Reign exploit chain and QuaDream attribution is credited to Citizen Lab; identification of the BLASTPASS exploit chain is credited to Citizen Lab in collaboration with Apple's Security Engineering and Architecture team; the vulnerability patches themselves are credited to Apple Inc.
Correction history
- 2026-10-19
Record first published.