Apple has once again warned numerous users on their iPhones, iPads, and Macs about possible spyware infections. The company sends such warnings in waves whenever it suspects that devices have been infiltrated with spyware. According to a Techcrunch report, the latest wave targeted users in a total of 110 countries. Since 2021, people in more than 150 countries have received such notices.
Targeted attacks on specific individuals
In a support article, Apple explains the background to these warnings. They relate to what's known as mercenary spyware, which includes software like Pegasus, developed by the NSO Group and used by some government agencies as state-sponsored spyware. Such attacks are typically directed by state actors. It's unclear exactly how many users were notified in the latest wave, but most Apple customers will never receive such a notice. Because deploying state spyware is very expensive, attacks usually target only select individuals in certain positions, such as journalists, activists, politicians, and diplomats. Apple puts it this way: mercenary spyware attacks cost millions of dollars and are often short-lived, which makes detecting and preventing them much harder.
What the warnings look like
On the iPhone, the notices appear as a notification that's also visible on the lock screen and in device settings. Apple additionally informs affected users by email and through a banner on the Apple Account page. The warnings deliberately don't include details about the specific attack detected. Apple explains that overly precise information could prompt attackers to change their behavior in order to avoid detection in the future.
What you should do
If you receive a spyware warning on an Apple device, you should take it seriously and quickly contact a security expert for advice on next steps. Citizen Lab researcher John Scott-Railton shared the same recommendation. He also advises anyone who sees themselves as a potential target of state-sponsored espionage to proactively enable Lockdown Mode, a feature that significantly reduces the attack surface of iPhone, iPad, and Mac.