Apple has enhanced its system for notifying individuals targeted by mercenary spyware, now displaying warnings directly on an iPhone's Lock Screen and within its Settings application. This new on-device alert aims to make high-risk notifications more prominent, supplementing existing alerts delivered via email and through a user's Apple Account page.
The company emphasizes that these "high-confidence alerts" signify that a user has been individually targeted by a mercenary spyware attack, urging recipients to take them very seriously. Such attacks are typically sophisticated campaigns associated with commercial surveillance vendors and their government clients.
Since the program's inception in 2021, Apple has issued threat notifications to targets in over 150 countries. The most recent wave of these notifications reached individuals in 110 countries. Mercenary spyware campaigns are generally not aimed at the average iPhone user but rather at specific individuals selected for their identity, knowledge, or profession.
However, the techniques developed for these narrowly targeted operations can spread, as exploits may be reused, resold, reverse-engineered, copied by other surveillance vendors, or adapted by criminal groups. A vulnerability initially valuable for compromising a small number of chosen devices can become more dangerous once public disclosure, patch analysis, or exploit sharing makes it available for broader campaigns.
Apple advises users to take several steps to enhance their security. These include updating devices to the latest software to ensure current security fixes are applied, protecting devices with a passcode, Touch ID, or Face ID, and using two-factor authentication with a strong password for their Apple Account. Users should also enable Stolen Device Protection, install apps exclusively from the App Store, and use strong, unique passwords or passkeys where available. Additionally, users are cautioned against opening links or attachments from unknown senders.
For those who believe they may be targets of mercenary spyware, Apple suggests enabling Lockdown Mode. The company also warns that scammers may attempt to mimic these notifications, advising users to verify any threat notification by signing in to their Apple account, where genuine alerts will always be listed. If a legitimate Apple Threat Notification is received, the company recommends seeking expert assistance, such as from the Digital Security Helpline provided by Access Now.
