Apple has issued a new round of "Threat Notification" alerts to users, indicating detection of highly targeted mercenary spyware attacks against their iPhones. These alerts, sent on August 13, are part of an ongoing initiative by Apple, which has been dispatching similar notifications multiple times a year since 2021.
The notifications are triggered when Apple's internal threat intelligence and investigations identify suspected mercenary spyware activity. While Apple does not disclose the specific spyware behind each alert, it has previously cited NSO Group's Pegasus as an example of the type of mercenary spyware historically associated with these attacks. Past forensic investigations into some recipients' devices have confirmed Pegasus infections.
Apple emphasizes that these are "high-confidence alerts," signifying that the company has strong evidence a user has been individually targeted. The company refrains from providing detailed information about the detection methods to prevent attackers from adapting their tactics to evade future detection.
Recipients of these alerts typically include individuals such as journalists, activists, politicians, and diplomats, who are frequently targets of such sophisticated and expensive attacks. Apple notes that these attacks often cost millions of dollars and have a short operational lifespan, making them particularly challenging to detect and prevent. The vast majority of users, Apple states, will never be targeted by such attacks.
The alerts are delivered via email from threat-notifications@email.apple.com and iMessage to the addresses and phone numbers linked to a user's Apple Account. Apple advises users to be wary of fraudulent alerts and provides methods for verification: genuine notifications will not ask users to click links, open files, install apps or profiles, or provide Apple Account credentials. Users can also verify an alert by logging directly into account.apple.com, where a legitimate notification will appear at the top of the page.
If a user receives a threat notification, Apple recommends enabling Lockdown Mode on their device and contacting a cybersecurity expert for further assistance. The company underscores the seriousness of these alerts, as they indicate a direct and individual targeting by mercenary spyware.
