Spyware targets in 110 countries now get Apple's warning on the Lock Screen

Apple is now alerting people it believes are targets of spyware right on the Lock Screen of their iPhone.

This is important for journalists, activists, and officials who are frequently impacted by these attacks. It places a high-stakes alert right where they cannot overlook it. The latest round of notifications on Thursday reached people in 110 countries.

The Lock Screen alert replaces an email that could sit unread

Apple has until now used email and a banner after signing into an Apple Account to alert users to threats.

Now, an “Apple Threat Notification” appears on the Lock Screen and inside Settings. This feature works in addition to the older email and account-page alerts.

The message informs the user that Apple “detected a mercenary spyware attack targeted at your iPhone. There are actions you can take now to help protect your data and device.”

Apple changed the experience so users can reach guidance on what to do next more quickly.

Researcher Pieter Arntz stated that a warning on the Lock Screen is much harder to miss than one buried in an inbox. He wrote, “The new on-device alert is meant to make a high-risk warning harder to overlook and complements notifications by email and through the user’s Apple Account page.”

Apple refers to these notifications as “high-confidence alerts that a user has been individually targeted by a mercenary spyware attack, and should be taken very seriously.”

These are campaigns that cost millions of dollars, burn fast once they are discovered, and are aimed at a tiny group of people.

Apple’s support documentation associates the attacks with state actors and the private companies that create surveillance tools for them, with Pegasus from Israel’s NSO Group as one example. The usual targets are journalists, activists, politicians, and diplomats.

Apple only uses its internal threat intelligence and won’t say what generates a specific alert, as that would help attackers avoid detection. The company says it has notified people in 150+ countries since the program began in 2021.

Apple’s latest round of threat notifications, which was on Thursday, reached 110 countries.

Apple says no Lockdown Mode device has been hacked

Apple’s advice to anyone who receives a notification is to enable Lockdown Mode, which removes features that attackers could exploit.

The company says it hasn’t yet seen a case of a device running Lockdown Mode being successfully hacked. It also directs recipients to the Digital Security Helpline run by the nonprofit Access Now, which is available 24/7.

A genuine warning is valuable bait, so recipients should check if any alert is legitimate by signing in to account.apple.com, where Apple says a real threat notification shows up clearly at the top of the page.

Apple says its real notifications never ask anyone to click on a link, install something, or give a password or verification code.

The smartest crypto minds already read our newsletter. Want in? Join them.