Apple confirmed sending a new wave of threat notifications on August 13 to targeted users in 110 countries, marking a significant escalation in security warnings that now appear directly on iPhone Lock Screens. The company stated that, to date, users in over 150 countries have been notified.

These alerts are considered high-confidence warnings indicating that an individual has been specifically targeted with unusually sophisticated spyware, according to Apple. The notifications advise users that there are actions they can take to protect their data and device.

Understanding the Warning

Apple's updated threat notifications feature a new user experience designed to provide crucial information and recommended security steps more accessibly. Beyond the Lock Screen, these warnings are also visible in Settings and are sent via email to addresses associated with an Apple Account. A warning will also appear upon logging into Apple's official account website.

The Lock Screen message states, "Apple detected a mercenary spyware attack targeted at your iPhone. There are actions you can take now to protect your data and device." Apple clarifies that mercenary spyware attacks are far more sophisticated than typical malware and scams, often involving significant financial investment by attackers targeting a small number of individuals.

Receiving a warning does not definitively mean spyware has successfully compromised the device, but rather that Apple has detected activity indicating an individual target. Apple does not identify specific attackers or countries in its notifications, citing a need to protect its detection methods from spyware operators.

Who is Targeted?

Apple states that these attacks historically target individuals based on their identity or activities, including journalists, activists, politicians, and diplomats. Public research has also linked such attacks to state actors and private companies developing surveillance tools.

Verifying Genuine Alerts

Apple urges users to be vigilant against potential phishing scams that may mimic these security warnings. Scammers could attempt to direct users to fake Apple login pages to steal account credentials. Genuine Apple threat notifications will never instruct users to click a link, open a file, install an app or profile, or provide Apple Account passwords or verification codes via email or phone.

To verify an alert, users are advised to open their browser directly and navigate to Apple's official account website, rather than trusting an unexpected email. If a threat notification was indeed sent by Apple, it will appear at the top of the user's account page.

Recommended Actions

If a genuine warning is received, Apple recommends users treat their device as a potential security incident and take immediate steps:

  1. Update iPhone Immediately: Users should go to Settings > General > Software Update and install the latest available version of iOS. Security updates often patch vulnerabilities that sophisticated attackers exploit. Apple emphasizes that keeping devices updated is a critical defense.
  2. Turn on Lockdown Mode: Apple specifically recommends Lockdown Mode for users who receive a mercenary spyware warning. This mode restricts certain apps, websites, and connections to minimize potential attack vectors. Apple has stated it is not aware of any successful mercenary spyware attacks against an Apple device while Lockdown Mode was enabled.
  3. Secure Apple Account: Users should ensure two-factor authentication (2FA) is enabled, review connected devices, and use a strong, unique password. A password manager is suggested for generating and storing such credentials.
  4. Be Suspicious of Follow-up Messages: Following public attention to these warnings, scammers may exploit fear. Users should not trust unsolicited calls claiming to be Apple Support and avoid clicking links in unexpected texts or emails about spyware.
  5. Watch for Compromise Signs: While not definitive proof, unusual activity such as unexplained apps, uninitiated settings changes, or other odd behavior may warrant further investigation.

General Device Security Tips

Even without a specific warning, Apple recommends several general security practices:

  • Keep Software Updated: Regularly install software updates to patch vulnerabilities.
  • Use Strong Passcodes/Biometrics: Employ Face ID, Touch ID, or strong device passcodes, avoiding simple four-digit codes.
  • Enable Two-Factor Authentication: Adds an extra layer of security to Apple accounts.
  • Enable Stolen Device Protection: Recommended for enhanced security.
  • Install Apps from App Store: Exercise caution with external software installations and check for suspicious configuration profiles.
  • Slow Down for Urgent Messages: Be wary of unexpected security warnings that create a sense of urgency, as they can be part of phishing attacks.
  • Use Strong Security Software: Employ reputable security software to protect against malicious links and phishing attempts.
  • Reduce Online Footprint: Consider using data removal services to limit publicly available personal information.
  • Consider Identity Theft Protection: Provides monitoring and recovery assistance if personal information is misused.