Apple has sent spyware warnings to users in 110 countries, alerting an unspecified number of people that they may have been targeted by what the company calls a “mercenary spyware attack.”
Apple recently confirmed the latest notifications while publishing a new support page explaining how its threat notifications work and what recipients should do.
The latest round brings the number of countries where Apple has issued these warnings over the past several years to more than 150. About a year ago, Apple warned users in 100 countries about suspected spyware attacks.
The company later confirmed that more than a dozen Iranians had also received warnings in the period leading up to the war with Israel.
Apple recommends Lockdown Mode
Apple recommends that anyone who receives a threat notification immediately enable Lockdown Mode, its hardened security setting designed to limit features that can be exploited during sophisticated attacks.
The company also directs targeted users to Access Now’s Digital Security Helpline, which provides emergency security assistance around the clock.
Apple said outside organizations assisting recipients do not know why a particular person received a notification, but can provide security advice based on the individual’s situation.
Apple does not disclose the techniques it uses to identify spyware attacks. The company says revealing those methods could help attackers change their techniques to avoid detection.
Most users will never see one
Apple says most people “will never be targeted by mercenary spyware,” which is typically used against journalists, activists, politicians and other high-profile individuals.
The company has nevertheless used the latest warning campaign to publish broader security advice.
Apple recommends keeping devices and apps updated, using a strong passcode or biometric authentication, enabling two-factor authentication for an Apple Account, turning on Stolen Device Protection and downloading apps only from the App Store.
It also recommends unique passwords and passkeys where available and warns users not to open suspicious links or attachments from unknown senders.
Mercenary spyware includes commercial surveillance tools such as Pegasus, developed by NSO Group. Apple began sending threat notifications in 2021 as it expanded efforts to detect sophisticated attacks targeting its users.
How Apple sends the warnings
Apple delivers threat notifications through email and iMessage, as well as a banner that appears at the top of the page when a user signs in to appleid.apple.com.
The company says recipients should take the notifications seriously and follow its security recommendations.
Apple has published additional information about threat notifications and recommended steps on its support website.
