Apple has issued a new round of threat notifications to customers who may have been targeted by mercenary spyware attacks.
In a statement shared with TechCrunch, Apple said it had notified users in 110 countries in the latest round of alerts. The company also said it has notified customers in more than 150 countries since it began sending these warnings in late 2021.
Apple Warns Users About Sophisticated Spyware Attacks
Apple describes mercenary spyware attacks as some of the most sophisticated digital threats currently in existence. These attacks are highly targeted and can involve significant financial resources, technical expertise, and time.
The company said it does not attribute the attacks or the resulting threat notifications to specific attackers or geographic regions because of the global and sophisticated nature of these threats.
People who receive these alerts may have been targeted because of who they are or what they do. Potential targets can include journalists, activists, politicians, diplomats, and other individuals who may be of interest to sophisticated surveillance operations.
Unlike conventional cybercrime, mercenary spyware attacks typically focus on a very small number of specific individuals and their devices.
What Is Mercenary Spyware?
Mercenary spyware is surveillance software developed and deployed by specialized commercial spyware vendors. Attackers can use sophisticated exploits to compromise devices and potentially access sensitive information.
These operations can be significantly more advanced than typical cybercrime because spyware developers may invest substantial resources into discovering vulnerabilities and developing techniques to deliver surveillance tools.
Apple considers its threat notifications high-confidence alerts indicating that a user may have been specifically targeted.
However, the company does not reveal exactly what evidence or technical indicators trigger an individual notification. Apple says that providing such details could help spyware operators modify their tactics and evade future detection.
How Apple Notifies Potential Victims
Apple uses several methods to notify customers who may have been targeted.
Users can receive a threat notification in three ways:
- iPhone alert: An Apple Threat Notification can appear on the iPhone’s Lock Screen and in Settings.
- Email notification: Apple sends an alert to the email addresses associated with the user’s Apple Account. The notification is sent from
threat-notifications@email.apple.com. - Apple Account notification: A threat notification banner can appear at the top of the user’s Apple Account page after signing in.
Users who receive an alert should take it seriously and follow Apple’s recommended security measures.
How to Protect Your iPhone From Spyware
Apple recommends several security measures that can help protect users from sophisticated cyberattacks.
Keep Your Devices Updated
Install the latest available software updates on your iPhone, iPad, Mac, and other Apple devices. Security updates can address vulnerabilities that attackers may attempt to exploit.
Use a Strong Passcode
Secure your device with a strong passcode and enable Face ID or Touch ID where available.
Enable Two-Factor Authentication
Two-factor authentication (2FA) adds another layer of protection to your Apple Account and can help prevent unauthorized access.
Turn On Stolen Device Protection
Apple’s Stolen Device Protection feature provides additional security if someone gains physical access to an iPhone.
Use Lockdown Mode
People who believe they could be specifically targeted by highly sophisticated cyberattacks can consider enabling Lockdown Mode. The feature is designed to reduce potential attack surfaces on Apple devices.
Avoid Suspicious Links and Attachments
Do not open unexpected links or attachments from unknown or untrusted senders. Phishing and social engineering can be used as part of attempts to compromise accounts or devices.
Download Apps From Trusted Sources
Install applications only from trusted sources and be cautious about software that requests unusual permissions or access to sensitive information.
What Should You Do If You Receive an Apple Threat Notification?
An Apple threat notification should not be treated like an ordinary security warning. Apple says these alerts are high-confidence notifications indicating that the company believes a user may have been individually targeted.
If you receive one, update your devices, strengthen your account security, enable available protective features such as Lockdown Mode when appropriate, and carefully review unexpected messages, links, and attachments.
Bottom line: Mercenary spyware attacks are highly targeted and sophisticated. Keeping Apple devices updated and using strong security protections can help reduce the risk of compromise.
