Apple and Android phones hacked by Italian spyware, says Google

Milan-based RCS Lab, whose website claims European law enforcement agencies as clients, developed tools to spy on private messages and contacts of the targeted devices, the report said.

European and American regulators have been weighing potential new rules over the sale and import of spyware.

The governments of Italy and Kazakhstan did not immediately respond to requests for comment. An Apple spokesperson said the company had revoked all known accounts and certificates associated with this hacking campaign.

RCS Lab said its products and services comply with European rules and help law enforcement agencies investigate crimes.

Google said it had taken steps to protect users of its Android operating system and alerted them about the spyware, known as Hermit.

The global industry making spyware for governments has been growing, with more companies developing interception tools for law enforcement. Anti-surveillance activists accuse them of aiding governments that in some cases use such tools to crack down on human rights and civil rights.

Google researchers found RCS Lab had previously collaborated with the controversial, defunct Italian spy firm Hacking Team, which had similarly created surveillance software for foreign governments to tap into phones and computers.

Hacking Team went bust after it became a victim of a major hack in 2015 that led to a disclosure of numerous internal documents.

Evidence suggests Hermit was used in a predominantly Kurdish region of Syria, the mobile security company said.

Analysis of Hermit showed that it can be employed to gain control of smartphones, recording audio, redirecting calls, and collecting data such as contacts, messages, photos and location, Lookout researchers said.

Google and Lookout noted the spyware spreads by getting people to click on links in messages sent to targets.

When not masquerading as a mobile internet service provider, the cyber spies would send links pretending to be from phone makers or messaging applications to trick people into clicking, researchers said.

Google said it has warned Android users targeted by the spyware and ramped up software defences. Apple told AFP it has taken steps to protect iPhone users.