Apple appears to be sending out a large wave of warnings to users it believes were targeted by mercenary spyware.
According to TechCrunch, the company started sending out its latest round of notifications to users in 110 countries on Thursday. Additionally, an unusually large number of people have also reported receiving the alerts over the weekend.
In a support page published last week, Apple described mercenary spyware attacks as highly sophisticated campaigns backed by “exceptional resources” that target a small number of specific people and their devices.
“Mercenary spyware attacks cost millions of dollars and often have a short shelf life, making them much harder to detect and prevent,” the company wrote.
Apple says these types of attacks have historically been tied to governments and utilize spyware from private companies like the NSO Group’s Pegasus. Targets of these attacks often include journalists, activists, politicians, and diplomats.
Apple says it has sent threat notifications several times a year since 2021 and has warned users in more than 150 countries.
But this latest round appears to be on a different scale.
Access Now, a digital rights group that Apple directs targeted users to for help, told TechCrunch that it received a record number of people reaching out following the latest alerts. The group’s Director, Mohammed Al-Maskati, said the number was about 30% to 40% higher than the organization typically sees after Apple sends a new round of notifications.
One reason for the uptick could be a change in how Apple warns users, which makes the alerts much harder to miss.
Starting this year, Apple began displaying threat notifications directly on users’ iPhone lock screens and in the Settings app, in addition to sending them by email and displaying them on a user’s Apple Account page. Apple notes that notification types can vary depending on a user’s device model and software version.
“Apple detected a mercenary spyware attack targeted at your iPhone. There are actions you can take now to help protect your data and device,” the lockscreen alert reads, according to a screenshot on Apple’s support page.
Receiving one of these alerts does not necessarily mean a device was successfully hacked. Apple says the notifications are high-confidence warnings that a user was individually targeted and should be taken seriously.
If spyware does successfully compromise a device, it can potentially give attackers nearly complete access to the information stored in a user’s phone. Spyware like Pegasus has been used to secretly surveil targeted phones, including photos, documents, and encrypted messages.
Apple advises anyone who receives an alert to enable Lockdown Mode, a security feature that restricts certain phone functions to make successful attacks more difficult. For instance, it blocks most message attachment types, limits incoming FaceTime calls from unfamiliar contacts, and restricts some web browsing features.
The company also recommends that targeted users seek expert help like Access Now’s Digital Security Helpline, which provides emergency cybersecurity assistance.
Apple did not immediately respond to a request for comment.
