Circuit Wire — a daily news update from the Circuit.
Apple sent a fresh batch of threat notifications on Thursday, August 13, warning iPhone users in 110 countries that they had been individually targeted by mercenary spyware. The company confirmed the figure to TechCrunch and said it has now alerted people in more than 150 countries since the program began in 2021.
The warning now arrives directly on the iPhone lock screen, a change Apple introduced with this round. It reads: "Apple detected a mercenary spyware attack targeted at your iPhone. There are actions you can take now to protect your data and device." Apple told BleepingComputer it had reworked the notification so recipients can find the relevant information and the recommended next steps more easily.
The alerts also go out by email and appear when a user signs in at account.apple.com. The emails come from [email protected], and Apple has warned that counterfeit versions circulate. In its support documentation, the company says a genuine notification never asks a recipient to click a link, open a file, install an app or profile, or supply an account password or verification code.
Apple does not name the spyware behind any individual alert and does not attribute the activity to a government, company or region. It cites NSO Group's Pegasus as an example of the category. Recipients are typically singled out because of who they are or what they do, and earlier batches have reached journalists, activists, politicians and diplomats. Apple describes the attacks as costing millions of dollars and having a short shelf life, which makes them harder to detect and prevent. Thursday's round is among the widest the company has issued, covering 110 of the more than 150 countries it has reached in five years.
Apple treats the notifications as high-confidence alerts rather than routine warnings, and its guidance points recipients toward Lockdown Mode. The company has said it has yet to see a case in which a device was compromised by spyware while Lockdown Mode was switched on.
John Scott-Railton, a senior researcher at the digital research group Citizen Lab, first flagged the latest batch publicly and described the lock screen alerts as a significant improvement on the approach Apple debuted in 2021. He has pointed to how the notifications repeatedly open wider investigations, including the scandal in Poland over the former government's use of Pegasus against political rivals. Apple has issued these batches several times a year since the program started.
Want a weekly roundup of the major stories shaping the security industry? The On The Circuit newsletter is read by more than 12,000 protection professionals.
Spotted something we should cover? Send tips and feedback via circuit-magazine.com.