Cybersecurity Firm: Harris-Walz Campaign May Have Been Hacked

Cybersecurity firm iVerify said Thursday that it has discovered evidence of a potential hacking campaign targeting a handful of iPhones belonging to five high-profile Americans, including former members of the Kamala Harris-Tim Walz presidential campaign.

One of the few companies to specialize in iPhone cybersecurity, iVerify's report contains a "significant amount of circumstantial evidence" indicating a breach, iVerify CEO Rocky Cole told NBC News.

Apple, the iPhone's manufacturer and a tech company known for its strong cybersecurity protections, has denied the firm's findings.

According to iVerify, the targets and level of technical sophistication suggest that a skilled spy agency may have been involved in the potential hacking operation.

It is unclear what triggered the investigation, but two people familiar with the matter told NBC that former members of the Harris-Walz campaign were believed to have been targeted.

The evidence points to a hacker remotely installing spyware — a type of invasive, malicious computer program — on the devices of targeted users last year in order to snoop through their data without their knowledge or permission, iVerify said.

In addition to the targeted Americans, the company found that a European government official's iPhone also appeared to have been exploited.

The company reportedly analyzed nearly 50,000 mobile phones and found six with evidence of remote tampering. The compromised phones all belonged to prominent individuals who would be high-value targets for espionage.

In a statement obtained by NBC, Ivan Krstić, the head of Apple Security Engineering and Architecture, disputed iVerify's report.

"We've thoroughly analyzed the information provided by iVerify and strongly disagree with the claims of a targeted attack against our users," Krstić said. "Based on field data from our devices, this report points to a conventional software bug that we identified and fixed in iOS 18.3."

Krstić added that Apple is "not currently aware of any credible indication that the bug points to an exploitation attempt or active attack."

In a statement of his own, Cole said "there is ample evidence in the report" that is "worth sharing with the research community."

"We've never claimed there is a smoking gun here, only a significant amount of circumstantial evidence," added Cole.

According to the company's report, iVerify researchers did not directly observe malicious software in action on the potentially compromised iPhones it analyzed. Instead, they found evidence that such programs had been installed and then deleted. Suspicious activity in the phones' crash logs indicates tampering, the company said.

"We identified exceedingly rare crash logs that appeared exclusively on devices belonging to high-risk individuals including government officials, political campaign staff, journalists, and tech executives," the report says. "At least one affected European Union government official received an Apple Threat Notification approximately thirty days after we observed this crash on their device, and forensic examination of another device revealed signs of successful exploitation."

Andrew Hoog, one of the founders of phone security company NowSecure, told NBC that iVerify's "analysis and conclusions" are "credible and consistent with what we've observed over nearly a decade of mobile zero-click attacks."