A significant number of Apple users have reported receiving alerts regarding potential spyware threats targeting their devices, according to experts investigating such incidents.
Over the weekend, many individuals shared their experiences of receiving Apple’s spyware notifications, which were part of a new round of alerts sent out on Friday to customers in 110 countries. The alerts informed them of being potential targets of sophisticated spyware.
Occasionally, Apple issues these notifications en masse to users who might have been targeted or compromised by malware, often utilized by governments, which Apple categorizes as “mercenary spyware.” In recent years, the company has alerted individuals across more than 150 countries.
This latest notice batch appears to be the largest so far, according to a digital rights organization that Apple recommends people contact for support regarding spyware incidents.
Mohammed Al-Maskati, director of the Access Now investigative team, shared that since the Friday alerts, they have seen a record number of inquiries for assistance, including from individuals who had previously received notifications.
Al-Maskati noted that this surge represents an increase of approximately 30% to 40% compared to typical response rates after Apple issues new alerts.
The cybersecurity firm iVerify also corroborated reports that they have been noticing a rise in threat notifications from Apple.
Numerous users have also taken to social media to discuss receiving these alerts over the weekend, marking a significant outpouring of public concern.
Get in Touch
If you have received a notification from Apple regarding being targeted with mercenary spyware, or possess information about spyware developers, we would like to hear from you. Contact Lorenzo Franceschi-Bicchierai securely on Signal, or through other secure messaging platforms.
One individual, a soldier from the Ukraine Armed Forces, shared his experience, stating that at first he assumed the notification was a scam until he confirmed its legitimacy with Apple.
“I was honestly surprised; I didn’t think I was significant enough to be targeted. But I suppose it’s somewhat flattering,” he mentioned.
He also noted that other colleagues in Ukraine’s military had received similar warnings, which caused them some alarm.
The Computer Emergency Response Team of Ukraine (CERT-UA) did not respond to inquiries about whether they are aware of other individuals in Ukraine, particularly military personnel, receiving these notifications.
John Scott-Railton, a senior researcher at The Citizen Lab, highlighted that these reports suggest a more widespread incidence of spyware attacks than previously acknowledged.
“The extent and diversity of public posts regarding these notifications are quite remarkable,” Scott-Railton observed. “For every public case, it’s reasonable to assume there are many more that remain undisclosed. This strongly indicates that a larger issue is at play.”
Experts Al-Maskati and Scott-Railton suggested that the increase in notifications could also be linked to Apple’s updated user alert strategies.
This year, Apple has begun notifying users directly on their iPhone lock screens, within the Settings app, via their associated email addresses, and when they log into their Apple Account online.
“Apple’s revamped notification approach has helped to elevate awareness around this serious issue, making it less likely for users to overlook it,” Al-Maskati commented.
Apple did not provide a response to requests for comments.
If you receive such a notification, take it seriously. If you don’t qualify as a journalist, dissident, or human rights advocate, there are alternative organizations available to help investigate.
Experts recommend enabling Lockdown Mode, a special security feature aimed at thwarting hacking attempts on iPhones, iPads, and Mac devices. Apple has stated that no users enabled with Lockdown Mode have been compromised.
This report has been updated with additional data from iVerify.
