Russia widens phone spyware investigation

Moscow’s main security agency said it had uncovered a foreign intelligence operation that placed spyware on mobile phones used by senior officials, intensifying Russia’s long-running confrontation with Western governments over cyber espionage, communications security and control of digital infrastructure.

Russia’s Federal Security Service said the operation involved the compromise of thousands of devices, including phones used by officials, diplomats and people linked to government agencies. The agency alleged that foreign intelligence services had used sophisticated surveillance software to infiltrate mobile devices and extract sensitive information, including communications, location data and other private material.

The disclosure placed mobile-device security at the centre of a wider intelligence dispute between Moscow and Western capitals. Russia has accused foreign agencies of using commercial technology platforms and software vulnerabilities to conduct surveillance. Western governments, meanwhile, have repeatedly accused Russian state-linked groups of cyber operations targeting ministries, embassies, defence contractors, energy systems and political organisations.

The FSB said the spyware campaign had targeted devices connected to Russian users and foreign diplomatic missions operating in Russia and neighbouring states. It alleged that the operation demonstrated the risks attached to reliance on foreign-made mobile technology inside government institutions. The agency did not publish a full technical forensic report identifying every exploit, command server or operator behind the campaign, leaving independent verification limited.

Cybersecurity researchers have previously documented advanced iPhone infections that used zero-click methods, meaning the device could be compromised without the user opening a link or downloading a file. Such attacks are among the most expensive and difficult forms of intrusion, usually associated with state-level operators or commercial spyware vendors selling tools to government clients.

One campaign examined by cybersecurity specialists involved malicious messages sent through iMessage, a chain of software flaws and a final spyware implant capable of extracting files, recording audio, tracking location and accessing user data. The malware was designed to operate quietly and remove traces of the original infection path, complicating efforts to identify victims and attribute the operation with certainty.

Apple has denied working with any government to create backdoors in its products. The company has also issued security updates addressing vulnerabilities that were used in advanced spyware attacks. Security analysts say the episode highlights a persistent problem for governments: even tightly controlled mobile ecosystems can become targets when attackers have access to unknown vulnerabilities and the resources to chain them together.

Russia’s response has included tighter restrictions on official use of foreign devices and pressure on ministries, state companies and public-sector bodies to shift sensitive communications away from products made by Western technology groups. Several government-linked organisations have discouraged or limited the use of iPhones for work, citing espionage risks. Moscow has also promoted domestic software, secure messaging systems and locally controlled infrastructure as part of a wider digital-sovereignty agenda.

The phone-spyware allegation came against the backdrop of a sharper global contest over cyber intelligence. The war in Ukraine has accelerated hostile activity across networks used by governments, defence suppliers, logistics firms and financial institutions. Intelligence agencies on both sides have sought to penetrate communications systems, monitor diplomatic traffic and gather information on sanctions, weapons supplies and military planning.

Russia’s own cyber capabilities remain under intense scrutiny. Western security agencies and private researchers have linked Russian state-backed groups to espionage campaigns against embassies, think tanks, government agencies and critical infrastructure. Moscow denies conducting hostile cyber operations, while accusing the United States and its allies of using technology dominance to conduct surveillance abroad.

Mobile phones have become a priority target because they contain dense stores of personal and official information. A single compromised device can expose messages, contacts, travel patterns, call records, photographs, authentication codes and access to cloud services. For officials and diplomats, that can open a path to wider institutional networks.

The spyware industry has also drawn growing regulatory scrutiny. Commercial surveillance tools have been found on phones belonging to journalists, activists, lawyers, opposition figures and government officials in several countries. The spread of such tools has blurred the line between lawful intelligence gathering, political surveillance and cross-border cyber operations.

For Russia, the latest allegation strengthens the government’s case for stricter limits on foreign technology in sensitive state work. For technology companies, it adds pressure to identify flaws faster, expand lockdown protections and cooperate with independent security researchers without yielding to demands for backdoor access. For diplomats and officials, it is another warning that encrypted messaging and premium devices do not remove the risk of compromise when attackers can exploit weaknesses below the level visible to ordinary users.