Chrysaor/Trident

malware OpenTrojan Threat Intelligence

iOS/Android spyware using Trident chain

Source Attribution

Origin
MITRE
Source
Lookout/Citizen Lab
Verified
2026-08-26T16:11:50.351Z
Confidence
high

Source: Lookout/Citizen Lab · Verified: 2026-08-26T16:11:50.351Z · Confidence: high

Security Timeline

  • discovered Chrysaor/Trident first observed
  • updated Encyclopedia entry reviewed (Phase 45C)

Quick Answer

Chrysaor is spyware that used the 2016 Trident exploit chain on iOS and Android targets. (attributes recorded from Lookout/Citizen Lab).

Definition

Chrysaor is spyware that used the 2016 Trident exploit chain on iOS and Android targets.

Overview

Chrysaor is spyware that used the 2016 Trident exploit chain on iOS and Android targets.

Behavior

  • Three-bug iOS chain
  • targeted spyware

First Seen

2016-08

Target

iOS/Android spyware using Trident chain

Malware Intelligence

Family: Chrysaor/Trident

Techniques: T1471, T1419

Targets: iOS/Android spyware using Trident chain

Behavior:
  • Three-bug iOS chain
  • targeted spyware

References

Have a follow-up question?

Ask OpenTrojan's evidence-backed assistant about this topic — answers cite their sources.

Ask AI about this Start an investigation

Start Investigation

Move from reading to investigating Chrysaor/Trident. The workspace is a structured analysis surface — not a chat — organised as:

  1. Question — what do you need to know about Chrysaor/Trident?
  2. Evidence — assertions mapped to verifiable references.
  3. Timeline — events in chronological order.
  4. Related Entities — CVE, threat actor, campaign, malware links.
  5. Sources — NVD, CISA KEV, MITRE ATT&CK, vendor advisories.
  6. Notes — your own observations and working hypotheses.

AI assistance is limited to summarising, explaining, and suggesting related evidence. AI never completes your investigation, modifies entity relationships, or generates facts — all published analysis stays human-reviewed.

Start Investigation Open Workspace

Recommended Tools

Every tool runs passively or locally — inputs are never stored and no target is scanned.Start an investigation on this entity →