Follow ZDNET: Add us as a preferred source on Google
ZDNET’s key takeaways
- Apple is warning certain users about targeted spyware attacks.
- These attacks are aimed at journalists, activists, politicians, and diplomats.
- Anyone notified should enable Lockdown Mode on their iPhone, iPad, or Mac.
Apple is warning certain users about a new round of targeted attacks designed to infect their iPhones, iPads, and Macs with what it calls mercenary spyware. If successful, the spyware is able to bypass any built-in encryption to access your private files, snoop on your conversations, capture your audio and video, track your locations, and control your device.
Also: Older iPhones have an unfixable security flaw – why it can’t be patched and the models affected
Sharing the latest details with TechCrunch, Apple said that it sent the notifications to select customers on Thursday across 110 countries. The spyware is dubbed mercenary because it’s typically carried out by, or deployed on behalf of, nation states. Further, the attacks aren’t aimed at the average person but rather at people with prominent roles in society, including journalists, activists, politicians, and diplomats. Still, if you’re a victim, the damage can prove devastating.
“Such attacks are vastly more sophisticated than regular cybercriminal activity, as mercenary spyware attackers apply exceptional resources to target a very small number of specific individuals and their devices,” Apple said in an updated support page about its notifications. “Mercenary spyware attacks cost millions of dollars and often have a short shelf life, making them much harder to detect and prevent.”
As described and displayed by John Scott-Railton, a senior researcher at security research center Citizen Lab, the notice appears on your device as an Apple Threat Notification. The actual text reads: “Apple detected a mercenary spyware attack targeted at your iPhone. There are actions you can take now to help protect your data and device.”
These attacks often come in waves. Apple sent out such notifications twice during 2024, warning users about mercenary spyware attacks directed against them. On its notifications page, the company said that it has sent users these warnings multiple times a year and to date has alerted people across more than 150 countries.
Also: You’re charging your phone all wrong: 6 common myths, debunked
One company in particular that has often been accused of fomenting such attacks is NSO Group. The maker of the infamous Pegasus spyware typically denies any culpability, claiming that it sells the product only to intelligence and law enforcement agencies in their fight against terrorists and criminals. However, Apple and other firms have sued NSO Group, while vendors have been forced to patch software vulnerabilities exploited by Pegasus.
If you do receive a warning, what should you do?
First and foremost, enable Lockdown Mode on your device. This security feature blocks most message attachments and link previews, restricts advanced web technologies, limits incoming FaceTime calls, disables features like SharePlay and Game Center, and stops certain Apple service invitations.
Lockdown Mode also removes shared photo albums, excludes location data from shared images, requires devices to be unlocked before they connect to accessories or computers, blocks unsecure Wi-Fi networks, and prevents device management profiles from being installed.
To enable Lockdown Mode on an iPhone or iPad, head to Settings and select Privacy & Security. Swipe down to the bottom of the screen and tap Lockdown Mode. Then just tap the link for Turn On Lockdown Mode. On a Mac, go to System Settings, select Privacy & Security, choose Lockdown Mode, and then click the button to turn it on.
Also: Why Apple’s iOS 26.6 is worth installing (it’s not just for the 91 security fixes)
Otherwise, there are other actions all Apple users should take whether or not they’re targeted by these spyware attacks.
- Always update your device to the latest software version with the latest security fixes.
- Make sure you protect your device with a passcode, Touch ID, or Face ID.
- Turn on Stolen Device Protection.
- Use a strong password and two-factor authentication for your Apple Account.
- Install apps from the App Store.
- Use strong and unique passwords online and passkeys where supported.
- Don’t open links or attachments in emails or text messages from unknown senders.