NEW YORK — The message appeared on the lock screen before the phone was even unlocked: “Apple detected a mercenary spyware attack targeted at your iPhone.” For the thousands of people who saw that notification last week — journalists, civil servants, diplomats, and individuals who still cannot explain why they were chosen — it arrived with a single urgent question attached: now what?
Apple sent threat notifications to users in 110 countries between Thursday and the weekend, the largest single sweep in the four-year history of its threat notification program. Digital rights organization Access Now reported receiving 30 to 40 percent more inquiries after this wave than after any previous Apple alert cycle — a volume record for the organization’s Digital Security Helpline, which assists journalists, activists, lawyers, and civil society members navigate suspected surveillance.
The notification does not confirm a compromise occurred. Apple is careful to describe it as a high-confidence assessment that a specific individual was targeted — not proof that mercenary spyware was successfully installed on their device. The distinction matters legally and forensically, even if it provides cold comfort to the person reading the alert.
The lock screen placement is new. Previous rounds of Apple threat notifications arrived as push alerts and emails — visible, but easy to dismiss or miss entirely. Placing the message on the lock screen, where it appears before the user enters a passcode, makes it substantially harder to ignore. Apple also sends a simultaneous email to the address on file with the user’s Apple Account and displays a notification at account.apple.com.
The recommended immediate response for anyone who receives an alert is Lockdown Mode, Apple’s opt-in security configuration introduced in 2022. Lockdown Mode restricts iMessage link previews, blocks wired connections from unrecognized accessories, limits certain web browsing features historically exploited in zero-click attacks — exploits that require no interaction from the target — and disables several other functions that mercenary spyware operators have relied upon. Apple and Amnesty International’s Security Lab have both stated that no device running Lockdown Mode has been successfully compromised by mercenary spyware since the feature launched. That record now spans four years.
Apple has operated its threat notification program since 2021, alerting users across more than 150 countries cumulatively. The company declined to identify which countries saw the highest concentration of alerts in this wave, which specific spyware tools triggered the detection methodology, or what distinguishes this campaign from previous rounds. Disclosure would risk allowing the operators behind these tools to adapt.
Mercenary spyware — surveillance software sold commercially to governments and private actors for law enforcement and intelligence purposes — has expanded well beyond the state actors who once monopolized it. NSO Group’s Pegasus spyware became the most extensively documented case after a consortium of investigative journalists revealed in 2021 that it had been deployed against phone numbers belonging to heads of state, journalists, human rights lawyers, and business executives in dozens of countries. Apple subsequently filed a lawsuit against NSO Group. NSO has maintained that its tools are sold exclusively to vetted government clients under legal oversight. The case continues.
The attacks that prompt Apple’s notifications carry steep costs. The company has stated that mercenary spyware operations cost “millions of dollars” and have “a short shelf life” — a reference to the fact that each software vulnerability exploited by these tools is usable only until a patch closes it, forcing operators to acquire new zero-day exploits at comparable expense. That cost structure is why targeted populations tend to be individuals in specific high-exposure categories rather than mass populations.
For most iPhone users, practical guidance remains consistent with standard practice: keep iOS current, treat unexpected links with suspicion, and limit iMessage to contacts you know. For people in elevated-risk categories — journalists covering sensitive stories, dissidents operating abroad, opposition politicians, and diplomats in adversarial postings — the threshold is different. The same questions about digital access and accountability running through this wave have surfaced in other high-profile legal settings: the ongoing Meta children’s privacy trial has pressed similar arguments about the reach of digital monitoring in private life.
Apple has not determined, and external researchers have not yet established, whether this wave reflects a genuine expansion in the use of mercenary spyware — more governments, more operators, more targets — or whether Apple’s own detection capability has become more sensitive. Both scenarios produce identical lock screen alerts in the hands of identical recipients. The answer would significantly change the picture of how aggressive the commercial surveillance market has become. It is not yet available.
Related Posts
