Apple has sent threat notifications to users in 110 countries warning of mercenary spyware attacks, with over 150 countries notified to date. The alerts, delivered via push notifications and email, urge recipients to enable Lockdown Mode and seek expert help.
Apple’s latest round of threat notifications has reached users in 110 countries, marking another escalation in the tech giant’s efforts to alert individuals targeted by mercenary spyware. The warnings, which include direct push notifications on iPhones, iPads, and Macs, are part of a broader campaign that has now reached customers in over 150 countries. A new support document published by Apple details the steps users should take upon receiving such alerts, emphasizing that while the notifications do not confirm a breach, they signal a potential targeting that requires immediate action.
Scope of the Notifications
The notifications, first reported by TechCrunch, were sent to users in 110 countries on Thursday, with Apple confirming the rollout in a statement. The company has now notified customers in over 150 countries to date. Apple says that those being targeted will generally be high-profile, like government officials, activists, journalists, military, or law enforcement, due to the high cost of such attacks. Normal users should not worry about receiving a threat notification, and the likelihood of a random civilian being targeted is near zero.
The alerts arrive with a specific message: Apple detected a mercenary spyware attack targeted at your iPhone. There are actions you can take now to protect your data and device.
Users also receive an email and are prompted to log in to their accounts for additional details. The notifications are part of Apple’s broader strategy to combat surveillance, which has seen a proliferation in recent years.
Steps to Mitigate Risk
Upon receiving a threat notification, Apple advises users to immediately enable Lockdown Mode, a security feature that makes it far more difficult for spyware attacks to succeed. The company states that it has yet to see a case where someone’s device was hacked while Lockdown Mode was enabled. In addition to this, Apple suggests notified users enlist expert help, such as the rapid-response emergency security assistance provided by the Digital Security Helpline at the nonprofit Access Now.
The guidance also includes general cybersecurity best practices, such as updating devices to the latest software, protecting devices with a passcode, Touch ID, or Face ID, using two-factor authentication and a strong password for an Apple Account, turning on Stolen Device Protection, installing apps from the App Store, using strong and unique passwords online and passkeys where available, and not opening links or attachments from unknown senders. While these measures are available for all users, Apple acknowledges that most users will never be targeted by mercenary spyware. However, the company stresses the importance of taking the alerts seriously.
Expert Perspectives on the Impact
John Scott-Railton, a senior researcher at digital research group Citizen Lab, praised Apple’s approach, calling the notifications a big improvement
in urging users to seek help. Notifications create a critical signal that a community is being targeted,
he said. People get an alert, and then some of them reach out and seek help. Often this kicks off an investigation that reveals many, many more cases.
Scott-Railton cited the ongoing scandal in Poland over the former government’s use of spyware against its rivals as a prime example of how such alerts can uncover abuse of surveillance technology.
He also highlighted the role of Apple’s notifications in exposing the former Polish government’s use of spyware against its political rivals. Without Apple’s notifications, that entire massive scandal about spyware abuse in the Polish election wouldn’t have been uncovered,
he noted. This perspective underscores the broader implications of Apple’s alerts, which go beyond individual user protection to contribute to accountability in the use of surveillance tools.
Unanswered Questions and Next Steps
While Apple’s notifications have been reported, the number of users or types of entities targeting them was not shared. As the proliferation of surveillance technology continues, the next critical step will be how users respond and seek help to secure their devices.
For now, users receiving these alerts are advised to follow Apple’s guidance closely. The company’s ongoing efforts to notify and protect its users highlight the growing intersection between corporate responsibility and global cybersecurity.
Worth a look
