Apple notifications alert victims in 99 countries about mercenary spyware infections

Skip to main content

Get our latest cybersecurity news first on Google.

Click here!

Apple has sent new notifications of mercenary spyware infections to almost 100 countries, with recipients including journalists and documentary filmmakers.

“Today’s notification is being sent to targeted users in 99 countries, and to date we have notified users in over 150 countries in total,” the company said. “The extreme cost, sophistication, and worldwide nature of mercenary spyware attacks make them some of the most advanced digital threats in existence today. As a result, Apple does not attribute the attacks or the notice you’re receiving to any specific attackers or geographical regions.”

Apple didn’t immediately respond to a request for comment Friday about the countries targeted. Researchers and groups that work on spyware said the notifications were significant, however.

“This again promises to be an important set of notifications with a bunch of cases, based purely on what we see publicly,” said John Scott-Railton, senior researcher at The Citizen Lab at the University of Toronto. He also posted on social media about how potential victims could defend themselves, warning people to be cautious about companies that offer paid solutions to spyware infections.

He cautioned that the lack of notification doesn’t rule out an infection. The steps Apple recommends, which Scott-Railton seconded, were to enable Lockdown Mode and to get in touch with the digital rights group Access Now.

“The number of Apple threat notifications we are seeing from countries around the world indicates that the fight against the scourge of spyware abuse is far from over,” said Natalia Krapiva, senior tech-legal counsel with Access Now. “While we have increased our capacity to investigate spyware abuse, and companies like Apple have done a lot to notify and protect people from it, repressive states continue to use these powerful surveillance technologies, including against civil society actors and opposition figures.”

Apple sent its last major batch of notifications in August. The notifications frequently lead to victims approaching Access Now, The Citizen Lab and other groups seeking further assistance and prompting deeper investigations.

The notifications come shortly before the final rounds of negotiations over industry standards for commercial hacking tools being developed under the voluntary Pall Mall Process. The industry guidelines follow an earlier set of guidelines catered to governments.

“The states that will ultimately adopt these guidelines must come to terms that the current system is not working, and that the spyware industry must face some real consequences for the uncontrolled sale of these tools and refusal to curb the abuses,” Krapiva said.

More Scoops

Latest Podcasts

Government

• China-backed threat group used agentic AI pentesting tool to compromise 140 sensitive targets in 11 days

• Defense contractor pleads guilty to aiding North Korean remote worker scheme

• Leak site publishes data on more than 41,000 DHS employees obtained by hacktivists

• Prosecutors charge Madagascar scammers in NFT-stealing scheme based on fake online dating profiles

Technology

• eMudhra kills its certificate business after researchers cracked its private keys in under a second

• Wyden seeks adoption of encryption tech at hundreds of federal agencies to protect visitors’ sensitive traffic

• DHS to ban DeepSeek from federal civilian agencies

• The next election influence campaign will target your AI chatbot

Threats

• Syrian hacker who served Assad regime gets 42 months in US prison

• Officials seize domain of top bulletproof hosting provider Virtualine

• Researchers uncover Volt Typhoon’s covert, ephemeral network

• Prolific Hive and Nefilim ransomware affiliate sentenced to 70 months in prison

Policy

• National cyber director rolls out latest pilot in South Carolina, this time for rural hospitals

• Senators, rights groups say Trump administration breaking law by withholding surveillance court opinion

• CISA publishes strategy with eye on the next four years

• Exclusive: Bipartisan bill would develop federal guidance for distillation attacks, convene industry on defensive cyber