Threat Intelligence · Privacy
Apple warns users in 99 countries about mercenary spyware
Apple has sent threat notifications to users in 99 countries, warning them about possible mercenary spyware infections. Journalists and filmmakers are among those targeted, but Apple has not named the attackers.
Ross GrantUpdated 3 min read
The short version
Apple has warned people in 99 countries that their devices may have been targeted by mercenary spyware. These are advanced surveillance tools that can secretly access information on a phone or computer. Journalists and filmmakers are among those affected. Apple has not said who is behind the attacks or what information was taken.
By the numbers
- 99countries where users received Apple spyware notificationsRecorded Future News, CyberScoop
- 150+countries notified by Apple about spyware threats to dateCyberScoop
What happened?
Apple has sent threat notifications to users in 99 countries, warning them of possible mercenary spyware infections. The alerts were received by journalists and filmmakers, but Apple has not named the attackers or said what data was accessed. The company has not made a public statement on its website about the notifications.
Who is affected
Apple has sent new threat notifications to users in 99 countries, warning them about possible infections with mercenary spyware. The targets include journalists and documentary filmmakers. For example, Ragıp Soylu, a Turkey-based reporter, and Radwan Mortada, a Lebanese documentary filmmaker and investigative journalist, both reported receiving these alerts. According to Recorded Future News (opens in a new tab), this is the third notification this year for Soylu. Mortada has previously been targeted with Pegasus spyware in 2017 and 2021.
Apple said that, to date, it has notified users in over 150 countries about similar threats, according to CyberScoop (opens in a new tab).
What was taken
The notifications do not specify what data may have been accessed or stolen. However, mercenary spyware is known for its ability to access sensitive information on a device, including messages, emails, contacts, and sometimes even microphone or camera feeds. Victims are often people who handle sensitive information, such as journalists, which increases the risk to their sources and contacts.
How the attack worked
Apple has not attributed these attacks to any specific group or country. The company said the "extreme cost, sophistication, and worldwide nature of mercenary spyware attacks make them some of the most advanced digital threats in existence today." According to threat researcher Costin Raiu, there are no clear signs in the logs that would confirm which actor is responsible. The attacks are believed to use advanced spyware that can infect devices without any action from the victim (sometimes called "zero-click" attacks).
The response
Apple has not made a public statement on its website about these notifications. However, the company has evolved its notification system since August to make alerts more visible and to encourage users to take action. Experts at Citizen Lab and Access Now recommend that recipients enable Lockdown Mode on their Apple devices and contact digital rights groups for support. Lockdown Mode is a special setting in Apple devices that limits certain features to reduce the risk of spyware attacks.
Rights groups are calling for stricter controls on the sale and use of commercial spyware. The notifications come just before final negotiations over industry standards for commercial hacking tools under the Pall Mall Process, which aims to set voluntary guidelines for the industry.
What you should do
If you receive a threat notification from Apple, enable Lockdown Mode on your device and seek help from digital rights organisations such as Access Now. Be cautious of companies offering paid spyware removal solutions, as they may not be effective. Even if you do not receive a notification, it does not guarantee your device is safe from spyware. Regularly update your device and use strong privacy settings.
Why it matters
Mercenary spyware can secretly access sensitive information on a device, putting journalists, activists, and their sources at risk. The scale of these alerts shows that commercial spyware remains a widespread and serious threat.
Key points
- Apple sent spyware threat notifications to users in 99 countries.
- Journalists and filmmakers are among those targeted.
- Apple has not named the attackers or said what data was accessed.
- Experts recommend enabling Lockdown Mode and seeking help from digital rights groups.
- Commercial spyware remains a global threat to privacy and safety.
Sources
Recorded Future News
Reference
CyberScoop
Reference
