NSO Group Adds 'MMS Fingerprinting' Zero-Click Attack to Spyware Arsenal

A researcher uncovered a previously unreported NSO Group capability called "MMS Fingerprint" that leverages the MMS/WSP Push notification and the subsequent HTTP GET to harvest device User-Agent and header information without user interaction. This zero-click profiling could be used to tailor Pegasus spyware or craft more effective social-engineering attacks; the researcher reproduced the fingerprinting in tests but found no indication it has yet been used in real-world attacks.