Apple now sending alerts directly to iPhone when someone is targeted by Pegasus-like spyware

Apple has sent a fresh round of threat notifications to users it believes were individually targeted by mercenary spyware.

In Short

• Apple sent fresh threat notifications to targeted users across 110 countries
• The company says mercenary spyware attacks are costly, sophisticated and global
• Alerts also appear by email and atop the user's Apple Account page

Apple is warning users who may have been targeted by mercenary spyware. The company is sending threat notifications to affected users, with the alerts now appearing directly on an iPhone’s Lock Screen and in Settings. The latest round of notifications was sent to users in 110 countries this week informing users about the detected mercenary spyware attack and include safety precautions.,

In an updated support note published on August 13, Apple says its threat notifications are designed to inform and help people who may have been individually targeted by mercenary spyware attacks.

The company says mercenary spyware attacks are far more sophisticated than regular cybercrime, can cost millions of dollars and target only a very small number of people. Apple also reassures users that the vast majority of people will never be targeted by such attacks.

Pegasus-like spyware attacks are highly targeted

Apple explains that these attacks have historically been linked, through public reporting and research, to state actors and private companies that develop spyware on their behalf. The company cites Pegasus, developed by NSO Group, as one example. Journalists, activists, politicians and diplomats have been among those targeted in such attacks. However, Apple says it does not link individual threat notifications to any specific attacker or region.

How Apple identifies mercenary spyware

Apple says it uses its own threat intelligence and investigations to identify signs that an iPhone may have been targeted by mercenary spyware. The company calls these “high-confidence alerts”, but says it cannot be 100 per cent certain in every case.

Apple does not explain exactly what it looks for before sending an alert. The company says revealing those details could help spyware makers change their methods and avoid detection.

Apple says it has been sending these alerts multiple times a year since 2021 and has notified users in more than 150 countries

The warning now appears directly on iPhone

While Apple has been sending these notifications for years, the latest round brings an update. The company is now sending the warning directly to the iPhone Lock Screen, with the alert also appearing in Settings. Apple says the change is intended to make it easier for recipients to see the warning and find information about what to do next.

The company also sends an email to the address linked to the user’s Apple Account and displays a warning banner at the top of the account page after signing in.

The notification tells the user that Apple detected a “mercenary spyware attack targeted at your iPhone” and explains that there are steps they can take to protect their data and device. Apple recommends enabling Lockdown Mode and seeking expert help if necessary.

Apple warns about fake spyware alerts

Apple is also making it clear that users should be careful about scams pretending to be these warnings. A genuine Apple threat notification will not ask users to click a link, open a file, install an app or profile, or share their Apple Account password or verification code.

If users receive an alert and want to check whether it is real, Apple says they should sign in directly to account.apple.com rather than following links in an email or message. A genuine notification will be clearly displayed at the top of the account page.

- Ends