Cyberpediaby Brain
ENDEFR

Pegasus and FORCEDENTRY on iPhone

What the sources say about Pegasus on iPhone: exploited flaws, Apple's September 2021 fixes and simple habits for employees.

In 30 seconds

Where it happens
On iPhone and Android, through flaws in the system or the browser12.
What the attacker wants
To run their own code on the device, then move from limited access to extended rights1.
The reflex
Install updates without delay, because they often contain fixes for vulnerabilities1.
If it has already happened
Tell the company security team right away, and do not try to clean the phone yourself.

What it is

Pegasus appears in the MITRE ATT&CK framework as "Pegasus for iOS", software that exploits iOS vulnerabilities to escalate its privileges1. For an employee, the consequence is simple: an up-to-date phone is harder to compromise.

This article sticks to what the sources cited here establish. They describe the general logic of vulnerability-based attacks on mobile devices, a distribution of Pegasus for iOS through a website, and a batch of Apple fixes from September 2021. They contain no technical analysis of FORCEDENTRY, no detail of a zero-click infection through a message, and none of the 2021 investigations into Pegasus targets. Those points are therefore not covered here.

Straight answers

What is Pegasus for iOS?

In MITRE ATT&CK, "Pegasus for iOS" is software that exploits iOS vulnerabilities to escalate its privileges1. An Android version also exists: it tries to exploit known Android flaws for the same purpose1.

Do you have to click to be infected?

The sources cited here do not say so for Pegasus. They describe a case where the victim visits a website: Pegasus for iOS was distributed through a website, exploiting flaws in the Safari browser2. They note that, in this type of attack, the user sometimes has to help the process along, by enabling scripts or ignoring warning dialog boxes2.

What is CVE-2021-30860?

It is a vulnerability reference cited by CERT-FR in its 14 September 2021 advisory on Apple products, along with CVE-2021-308583. The advisory files these vulnerabilities under the risk "Exécution de code arbitraire à distance" (remote arbitrary code execution)3. The CERT-FR text does not link this reference to Pegasus.

Which devices does the CERT-FR advisory cover?

Affected are iOS and iPadOS before version 14.8, macOS Big Sur before 11.6, Safari before 14.1.2, watchOS before 7.6.2 and Catalina before 2021-0053.

How do you protect yourself?

MITRE states that security updates often contain fixes for vulnerabilities1. For website-based attacks, it writes that they frequently contain fixes for known exploits2.

1Inside the attacker's head1 min

An attacker targeting a phone starts with few rights. MITRE describes this starting point: the attacker first runs in a low-privileged process, which prevents access to some resources1. Flaws exist, most often in system components and applications that run with high privileges, and they allow a move from user level to root rights1.

Security mechanisms such as permission levels hinder access to data. To get around them, the attacker will probably have to exploit a software flaw1. This is the role MITRE assigns to Pegasus for iOS1.

When the target is chosen as a member of a community, the attacker can pick a site that this community visits: government, an industry or a region. MITRE calls this a strategic web compromise, or watering hole attack2.

2What you see on screen1 min

In the scenario MITRE describes for a website-based attack, scripts run automatically and look for the version of the browser and its plugins2. If a vulnerable version is found, the exploit code is sent to the browser. If the exploitation succeeds, the attacker gets code execution on the device, unless other protections are in place2. In some cases, a second visit to the site is needed before the code is sent2.

The sources cited here do not describe what the screen of an infected iPhone shows or does not show. They therefore do not allow the claim that no sign appears.

Another possible route, which concerns other malware: a link to an application, sent by email, SMS, iMessage or WhatsApp, or through a QR code4. MITRE notes that this technique is not easily bypassed with preventive controls, because it abuses normal system features4.

3Under the hoodIT teams1 min

The mechanism works in two steps. First an initial access, for example through the browser2. Then a privilege escalation, through a flaw in the system or in a component that runs with high privileges1.

MITRE cites several related pieces of software on iOS. INSOMNIA exploits a WebKit flaw to gain root access1. In Operation Triangulation, the attackers exploited a kernel flaw to gain root rights1.

A phone connected to the company network, locally or through a VPN, can also serve as an entry point. The attacker then exploits remote services to reach other internal systems5. Among the measures cited, configuring a per-application VPN rather than a device-wide one limits access to internal resources to approved applications only5.

The phone can also be affected before it reaches the user. MITRE describes supply chain compromise, which covers software dependencies, development tools and hardware6. Security updates can contain fixes for devices compromised at that level6.

On the defense side, device attestation can often detect a jailbroken or rooted phone, and mobile security products can too1.

4Case filesReal cases1 min

13 and 14 September 2021: the Apple fixes noted by CERT-FR

On 13 September 2021, Apple published five security bulletins, HT212804 to HT2128083. The next day, CERT-FR drew an advisory from them titled "Multiples vulnérabilités dans les produits Apple"3. It states that these flaws allow an attacker to cause remote arbitrary code execution3. The proposed solution is to refer to the vendor's bulletins to obtain the fixes3. The two CVE references cited are CVE-2021-30858 and CVE-2021-308603.

For an employee, the practical lesson is the advisory's own: versions before iOS 14.8 and iPadOS 14.8 were affected, and updating was the answer3.

Pegasus for iOS: distribution through a website

MITRE reports that Pegasus for iOS was distributed through a website, using flaws in the Safari browser on iOS2. The sources cited here give no date for this case.

Fact sheet

Identifier
CP-139
Wing
2. Malware and case files
Brain skill
Understanding Hacking Mechanics (understand_hacking)
Brain reflex
cr-012
Diagram
G3 · System & Protocol Anatomy
Languages
de, en, fr
Sources
6 sources checked on 3 November 2026
Sources6 sources
  1. MITRE ATT&CK, “Exploitation for Privilege Escalation, Technique T1404 - Mobile | MITRE ATT&CK®”. https://attack.mitre.org/techniques/T1404/ (accessed 3 November 2026)
  2. MITRE ATT&CK, “Drive-By Compromise, Technique T1456 - Mobile | MITRE ATT&CK®”. https://attack.mitre.org/techniques/T1456/ (accessed 3 November 2026)
  3. CERT-FR (ANSSI), “Multiples vulnérabilités dans les produits Apple - CERT-FR”, 14 September 2021. https://cert.cyber.gouv.fr/avis/CERTFR-2021-AVI-698/ (accessed 3 November 2026)
  4. MITRE ATT&CK, “Deliver Malicious Application via Other Means, Technique T1476 - Mobile | MITRE ATT&CK®”. https://attack.mitre.org/techniques/T1476/ (accessed 3 November 2026)
  5. MITRE ATT&CK, “Exploitation of Remote Services, Technique T1428 - Mobile | MITRE ATT&CK®”. https://attack.mitre.org/techniques/T1428/ (accessed 3 November 2026)
  6. MITRE ATT&CK, “Supply Chain Compromise, Technique T1474 - Mobile | MITRE ATT&CK®”. https://attack.mitre.org/techniques/T1474/ (accessed 3 November 2026)

Cite this article

Brain, “Pegasus and FORCEDENTRY on iPhone”, Cyberpedia, 2026. https://startbrain.io/cyberpedia/en/articles/pegasus-nso-forcedentry-iphone/

BibTeX 
@misc{brain_cp139_en_2026,
  author = {Brain},
  title = {Pegasus and FORCEDENTRY on iPhone},
  year = {2026},
  howpublished = {Cyberpedia},
  url = {https://startbrain.io/cyberpedia/en/articles/pegasus-nso-forcedentry-iphone/},
  note = {CC BY 4.0}
}
CC BY 4.0 licence