Investigators report 'unprecedented' surge in Apple spyware alerts

An unprecedented number of Apple customers have reported receiving a recent threat notification alerting them to suspected spyware attacks targeting their devices, according to experts who investigate these types of incidents. Several people publicly and privately reported receiving Apple’s spyware alerts over the weekend, after Apple sent a new wave of notifications Friday alerting customers in 110 countries that they had been targeted with powerful spyware.

Apple periodically sends these alerts in batches to customers it believes have been targeted or compromised with malware normally used by governments, which the company calls “mercenary spyware”; in the last few years, Apple says it has alerted people in more than 150 countries. The latest batch appears to have been the largest yet, according to one of the digital rights groups Apple suggests spyware victims contact for help.

Mohammed Al-Maskati, director of the Access Now team that reviews and investigates reports to the helpline, told TechCrunch that since Friday, they have received a record-high number of people reaching out for help, including people who had already received threat notifications in the past. Al-Maskati said the number is around 30% to 40% more than the nonprofit’s investigators usually receive after Apple sends new notifications. Cybersecurity firm iVerify also confirmed to TechCrunch it was seeing an influx of threat notifications from Apple.

An unusually large number of people have also publicly reported receiving these notifications over the weekend, according to several social media posts — including a Ukraine Armed Forces soldier who said he is fighting the war against Russia. The soldier, who asked to remain anonymous to protect himself, said he initially thought it was a scam until he verified it with Apple. “I was a bit surprised to be honest, I wouldn’t have thought I was important enough for them to target me like this. I am flattered though,” he told TechCrunch, adding that he knows other people in Ukraine’s military who received the same notification: “They were a bit worried.”

John Scott-Railton, a senior researcher at The Citizen Lab, which has investigated government spyware attacks for more than 15 years, told TechCrunch the reports show spyware attacks may be more prevalent than people realize. “The scale and geographic diversity of public posts about receiving notifications are pretty unprecedented,” he said. “For every public notification like this, you can imagine there’s a huge notification iceberg that the public will never learn about.”

Both Al-Maskati and Scott-Railton said the volume of people receiving alerts could also be partly attributed to Apple’s new notification methods: starting this year, Apple now notifies users on their iPhone lock screen, in Settings, via the email tied to their Apple account, and when they log in to their Apple Account on the web. Apple did not respond to a request for comment.

Why it matters

If notified, experts recommend turning on Lockdown Mode, a feature Apple says it is not aware of anyone bypassing while enabled; the scale of this batch suggests mercenary spyware campaigns are broader than public disclosures have previously shown.