Key points
- Dutch intelligence captured a Russian GRU operative in late 2017 and gained access to the hacker's servers.
- Agents reverse-engineered the method used to compromise Kushner’s iPhone X, enabling a continuous visual feed.
- Monitoring revealed access to a Dubai bank account linked to UAE and Saudi diplomatic funding.
Dutch intelligence services monitored the screen of Jared Kushner’s iPhone using a hacking technique originally developed by Russia’s GRU. According to an excerpt from Matthew Cole’s book Princes and Thieves, published in Vanity Fair, the Dutch agency did not develop the exploit themselves. Instead, they captured a Russian hacker and reverse-engineered the existing tool to gain their own access to the device. This surveillance occurred while Kushner was serving as a top envoy in the Trump administration.
How it unfolded
- In late 2017, Dutch intelligence services captured a Russian hacker who worked for the GRU.
- The operative provided access to a server containing screenshots of Kushner’s iPhone X screen.
- Dutch agents reverse-engineered the GRU method to establish a continuous image feed without audio.
- In early 2018, personnel began actively monitoring the phone and identified specific account logins.
Who is affected
The primary subject of this surveillance was Jared Kushner, who held a senior role in the Trump White House. Cole reported that Kushner was using a personal iPhone X rather than a secure government device during this period. He allegedly conducted official business using private email, which may have been routed to Trump Organization servers. Additionally, the report states that Kushner received Top Secret intelligence without a permanent security clearance at the time. These practices exposed his personal device to foreign intelligence monitoring.
What happens next
The monitoring identified Kushner logging into a Dubai-based bank account that had received approximately $750 million. Cole identified this as the Alpha account, held at First Abu Dhabi Bank. The account belonged to the Watani Al Emarat Foundation, which is funded by the United Arab Emirates government. The bank is chaired by the brother of UAE leader Mohamed bin Zayed. Cole reported that Kushner and MBZ partly managed this account as a slush fund for off-the-books diplomatic objectives.
The background in plain language
Foreign intelligence services often capture existing cyber tools rather than building new ones from scratch. When an agency captures an operative or seizes equipment, they can reverse-engineer the software to understand how it bypasses security. This allows them to deploy the same technique against other targets. For system administrators, this highlights the risk of zero-day exploits being reused. Teams usually assume a vulnerability is unique to one attacker, but it may be circulating among multiple state actors. Checking for signs of compromise requires monitoring for unusual data exfiltration patterns, even if the initial infection method remains unknown.
Background: Data exfiltration
Prevent data exfiltration by enforcing least privilege access and monitoring outbound traffic for anomalies. You must restrict who can touch sensitive data and verify where that data travels. Blocking common ports is insufficient because attackers use standard HTTPS channels to hide their activity.
Read the full guide: How to Prevent Data Exfiltration: Stop Silent Data Loss
What to do and how to stay safe: GRU
- Ensure all devices used for official business are issued by the organization and managed centrally.
- Prohibit the use of personal devices for handling classified or sensitive government information.
- Implement strict network monitoring to detect unauthorized access to sensitive accounts or banking portals.
- Verify that all personnel with access to sensitive data hold the appropriate security clearances.
Step-by-step guide: Mobile Device Security for Small Business: Control Without Cost
General security guidance from the Circuit Observer newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
How did the Dutch intelligence get access to Jared Kushner’s iPhone?
They captured a Russian GRU operative who provided access to a server with screenshots, allowing them to reverse-engineer the hacking method.
What kind of access did the Dutch spies have to the phone?
They had a continuous image feed of the phone’s screen, but they did not have access to audio.
What did the monitoring reveal about Jared Kushner’s activities?
It revealed he logged into a Dubai bank account linked to the Watani Al Emarat Foundation, which served as a diplomatic slush fund.
