Apple Spyware Alerts Surge: Record Number of Users Warned

An unusually large number of Apple device owners have recently received warnings about potential spyware attacks, according to cybersecurity investigators. Apple began issuing a fresh wave of these threat notifications on Friday, informing customers in 110 countries that their devices may have been compromised by sophisticated spyware, often employed by state-sponsored actors. These alerts, which Apple refers to as "mercenary spyware" notifications, are sent periodically to users believed to be targeted or compromised. While Apple has alerted users in over 150 countries in recent years, the latest batch appears to be the most extensive to date.

Digital rights organizations assisting individuals who receive these warnings have reported a significant increase in contact. Mohammed Al-Maskati, director of the Access Now investigative team, stated that his group has seen a record number of users reach out for assistance since Friday. He noted that the volume of inquiries is approximately 30% to 40% higher than typically observed after Apple releases such notifications, even including individuals who had received alerts previously. Cybersecurity firm iVerify also confirmed a surge in threat notifications being reported to them.

Increased Vigilance Amid Sophisticated Threats

The surge in notifications has also been widely discussed on social media platforms over the weekend, with numerous users publicly sharing their experiences. One such user, a soldier in the Ukrainian Armed Forces who wished to remain anonymous for security reasons, initially suspected the alert was a scam. However, upon verification with Apple, he confirmed its authenticity. "I was a bit surprised to be honest, I wouldn’t have thought I was important enough for them to target me like this. I am flattered though," the soldier told TechCrunch, adding that he is aware of other Ukrainian military personnel who have received similar warnings and expressed concern.

John Scott-Railton, a senior researcher at The Citizen Lab, a digital rights group with extensive experience investigating government spyware, commented on the situation. He indicated that these widespread reports suggest that spyware threats are more pervasive than commonly understood. "The scale and geographic diversity of public posts about receiving notifications are pretty unprecedented," Scott-Railton observed. "For every public notification like this, you can imagine there’s a huge notification iceberg that the public will never learn about. This is a clear indication that something bigger is going on."

Both Al-Maskati and Scott-Railton suggested that Apple's updated notification methods might be contributing to the higher volume of reported alerts. Starting this year, Apple now disseminates these warnings through multiple channels, including the iPhone lock screen, the device's Settings app, associated email accounts, and when users log into their Apple Account on the web. "Apple’s new notification method has helped raise awareness of the issue’s importance, making it harder for users to ignore," Al-Maskati explained. This enhanced visibility ensures that more users are aware of potential threats, leading to increased reports and inquiries.

Experts advise users who receive such notifications to take them seriously, regardless of their public profile. Organizations like Access Now offer assistance in investigating these threats. For enhanced security, Apple recommends enabling Lockdown Mode, a security feature designed to significantly bolster the protection of iPhones, iPads, and Mac computers against advanced cyberattacks. Apple has stated that no users with Lockdown Mode enabled have reported being compromised.