Apple warns iPhone users in 110 countries about spyware attacks

Apple has confirmed to TechCrunch that it has sent out a new wave of notifications alerting an unspecified number of users in 110 countries that they may have been targeted by a mercenary spyware attack. Apple has been running this warning program since 2021, and it has now sent these alerts to users in more than 150 countries in total.

The notifications do not name a specific company or spyware tool, though Apple has pointed to NSO Group's Pegasus as an example in the past, and researchers who looked into earlier rounds have confirmed Pegasus infections on some devices.

Apple calls these high-confidence alerts, meaning it is fairly certain a user was targeted, even though it will not explain how it detects the attacks. It keeps that part secret so attackers cannot learn how to avoid getting caught, and it notes that a notification does not prove a device was actually broken into, only that Apple spotted matching activity.

These warnings tend to go to journalists, activists, politicians, and diplomats, groups more likely to be targeted this way. Apple says the attacks are rare and expensive, often costing millions of dollars against a single person, which is why most iPhone users will never see one.

Anyone who gets a warning is told to turn on Lockdown Mode, a setting that limits certain iPhone features to make attacks harder to pull off, and to contact the Digital Security Helpline run by the nonprofit Access Now for free, around the clock help. Apple sends alerts through the Lock Screen, Settings, email from threat-notifications@email.apple.com, and a banner on account.apple.com, and it warns that a real notification will never ask someone to click a link, open a file, install an app or profile, or hand over their Apple Account password.

Apple has issued similar waves of warnings before, including one a little more than a year ago that reached users in 100 countries. It has also confirmed alerting more than a dozen Iranian cyberattack victims in the lead-up to the war with Israel. Apple has not said whether this latest round is tied to any single spyware campaign or group.