Apple’s latest threat warning confirms government spyware is alive and well
Apple has once again been forced to warn its customers about a fresh spate of state-adjacent mercenary spyware attacks, alerting people in 110 countries that they may have been targeted in some way.
If you receive a warning, act immediately
The company doesn’t send these notifications out for laughs, so if you have received one you should act immediately. The fresh set of warnings means Apple has now notified people in over 150 countries, reflecting the extent to which the scourge of government spyware has spread.
Tech news watchers will know this threat can only increase given the decision by the US administration to permit private security as a service mavericks to work directly for government agencies when targeting individuals abroad.
Apple has tweaked its system for these alerts.
In an updated tech support page, it promises to notify suspected victims of such attack directly on their iPhone lock screen with a push notification that urges the person to act.
What happens if you are warned
If you are a potential target you’ll receive a message that says, “Apple detected a mercenary spyware attack targeted at your iPhone. There are actions you can take now to protect your data and device.”
The first action you should take is to switch on Lockdown Mode and then get hold of expert help, such as the rapid-response emergency security assistance provided by the Digital Security Helpline at the nonprofit Access Now.
What the experts think
In a statement, Adam Boynton, Senior Security Strategy Manager, Jamf discussed some of the ramifications of the current set of warnings.
“A notification campaign spanning 110 countries sounds alarming, but it’s not a risk to the average iPhone user. Mercenary spyware is precision tooling, meaning that people are targeted because of who they are, what they know, and who they talk to. These tools rely on zero-day exploits precisely because the iPhone’s defences leave attackers no cheaper way in.
“Moving these alerts to the lock screen turns threat intelligence that used to sit in security research circles into something a targeted person sees within seconds as well as clear guidance on what to do next. Apple’s own data shows no known compromise of a device running Lockdown Mode, which shows Apple’s notification and the response are working.
“The mistake would be reading this as a story about journalists and activists alone. The economics of mercenary spyware mean the target list increasingly includes executives, negotiators, and anyone holding privileged access. If one of these notifications’ lands on a work device, it should be treated as a security incident from the first minute. Action needs to be taken to preserve the device rather than wiping it, enable Lockdown Mode, and bring in expert help.”
What everyone should do
Apple says, “Although the vast majority of users will never be targeted by mercenary spyware, all users can continue to protect themselves from general cybersecurity threats by following best practices for security:
- Update your devices to the latest software, which includes the latest security fixes.
- Protect your devices with a passcode, Touch ID, or Face ID.
- Use two-factor authentication and a strong password for your Apple Account.
- Turn on Stolen Device Protection.
- Install apps from the App Store.
- Use strong and unique passwords online — and passkeys where available.
- Don’t open links or attachments from unknown senders.”
You can follow me on social media! Join me on BlueSky, LinkedIn, Mastodon and subscribe to The Core.
