Apple Spyware Alerts Spike as 'Mercenary' Attacks Scale
AI-generated image · US National Wire
A record-breaking wave of threat notifications suggests that sophisticated government-grade spyware is reaching a broader, more diverse set of targets.
Apple has issued a massive wave of threat notifications to customers in 110 countries, alerting them that their devices were targeted by what the company calls “mercenary spyware”—malware typically utilized by government entities, as TechCrunch first reported. According to the reporting, the volume of these alerts is unprecedented.
Mohammed Al-Maskati, director of the Access Now team of investigators, told TechCrunch that the nonprofit has seen a record high number of individuals seeking help since the notifications began on Friday. Al-Maskati noted that the influx of reports is approximately 30% to 40% higher than what the organization typically experiences following Apple's notification cycles. The cybersecurity firm iVerify also confirmed to TechCrunch that it observed a surge in these threat notifications.
While Apple has alerted users in over 150 countries over the last few years, the current batch appears to be the largest to date. The geographic and numeric scale of the attack is reflected in public reports and social media posts. One anonymous Ukraine Armed Forces soldier told TechCrunch he received a notification and noted that other members of the Ukrainian military had received the same alert.
John Scott-Railton, a senior researcher at The Citizen Lab, told TechCrunch that the diversity and scale of these reports indicate that spyware attacks may be more prevalent than is widely understood. Scott-Railton described the public notifications as a “notification iceberg,” suggesting a much larger volume of undetected or private attacks is occurring. He stated that the current situation is a “clear indication that something bigger is going on.”
Some of the increase in reported cases may be linked to how Apple delivers these warnings. Al-Maskati told TechCrunch that Apple updated its notification methods this year to include alerts on the iPhone lock screen, within the Settings app, via account-associated emails, and during web logins. Al-Maskati noted these changes make it more difficult for users to ignore the warnings.
Apple did not provide a comment to TechCrunch's inquiries. Experts suggest that targeted users enable Lockdown Mode, a security feature for iPhones, iPads, and Macs. Apple has previously stated it is unaware of any instance where a user with Lockdown Mode enabled was successfully hacked.