Apple warns users in 99 countries of mercenary spyware infections

Fast Facts

1. Apple warned users in 99 countries of mercenary spyware targeting; it says notifications have reached people in more than 150 countries overall, including journalists and documentary filmmakers.

2. Apple did not identify attackers or regions. Researchers say the alerts point to a continuing, widespread threat—but no alert does not prove a device is safe.

3. People who may be targeted should enable Lockdown Mode and contact Access Now for help; experts warn against paying unverified spyware-removal services.

4. The alerts underscore the lack of effective controls on commercial spyware. As governments negotiate voluntary industry standards, advocates are calling for meaningful consequences for abusive sales and use.

The Issue

Apple has sent mercenary-spyware threat notifications to targeted users in 99 countries, bringing the total number of countries notified to more than 150. Recipients reportedly include journalists and documentary filmmakers. The alerts warn that users may have been targeted by highly sophisticated surveillance tools; however, Apple has not identified specific attackers or regions. The company says the global reach and complexity of these attacks make attribution difficult.

The notifications matter because spyware continues to be used against civil society members and opposition figures, despite efforts to warn and protect potential victims. John Scott-Railton of The Citizen Lab and Natalia Krapiva of Access Now said the alerts could lead to further investigations. They advised users to enable Apple’s Lockdown Mode and contact Access Now, while noting that receiving no alert does not prove a device is safe. CyberScoop reported the notifications, citing Apple and spyware researchers.

Critical Concerns

Apple’s spyware warnings to users in 99 countries show that sophisticated attacks can reach people connected to any business—not only governments or major corporations. If an employee’s phone is compromised, attackers may access messages, credentials, business contacts, and sensitive files. Consequently, they could steal intellectual property, enter company systems, impersonate staff, or disrupt operations. A breach may also trigger investigation costs, legal exposure, regulatory penalties, and lost customer trust. Even a small business can suffer: one targeted device can become a doorway into a much larger network. Therefore, treat these alerts as a serious security signal, and make sure staff know how to report them and seek expert help promptly.

Possible Next Steps

Timely remediation can shorten an attacker’s access, limit further exposure, and preserve evidence needed to understand the incident.

Recommended Steps

• Verify the alert (Detect): Go directly to Apple’s official support channels or account.apple.com on a trusted device. Save the alert and note when it arrived; don’t follow links in unsolicited messages.
• Protect sensitive communications (Protect): Use a separate, trusted device for confidential activity while the alerted device is assessed. Enable Apple’s Lockdown Mode if appropriate, recognizing that it reduces some risks but does not remove spyware.
• Update devices (Protect): Install current operating-system and security updates from official sources on Apple devices and other potentially exposed systems.
• Preserve evidence (Respond): Avoid deleting files, installing “cleaner” tools, or resetting the device before consulting a qualified responder; these actions may destroy useful evidence.
• Get expert assistance (Respond): Contact Apple Support and, where relevant, your organization’s security team or a reputable digital-security specialist. People at heightened risk—such as journalists, activists, or public officials—may also contact a specialized digital-security helpline.
• Secure accounts (Protect): From a trusted device, change important passwords, enable multifactor authentication, and review account sessions and recovery details. Prioritize email and Apple accounts.
• Contain and recover (Respond / Recover): Follow expert guidance on disconnecting, erasing, reinstalling, or replacing the device. Restore only from a backup considered clean, then monitor accounts and devices for renewed suspicious activity.
• Escalate as needed (Govern): If the device relates to work or sensitive organizational data, follow incident-reporting procedures and assess any legal, privacy, or notification obligations.

Advance Your Cyber Knowledge

Explore career growth and education via Careers & Learning, or dive into Compliance essentials.

Learn more about global cybersecurity standards through the NIST Cybersecurity Framework.

Disclaimer: The information provided may not always be accurate or up to date. Please do your own research, as the cybersecurity landscape evolves rapidly. Intended for secondary references purposes only.

Cyberattacks-V1