Thought Leadership
Apple has issued a second wave of warnings since August. The company has not identified the attackers or the spyware involved and recommends enabling Lockdown Mode.
Apple has once again warned users that they have been targeted by attacks involving commercial spyware. Notifications were sent to selected users in 99 countries. Security researcher Costin Raiu brought the latest wave to public attention. According to Raiu, the warnings are linked to new attacks and are separate from the notifications Apple sent to users in 110 countries in August.
“Today’s notification is being sent to affected users in 99 countries, and so far we have notified users in more than 150 countries in total,” Apple said in the statement published by Raiu.
Apple Withholds Details About Attackers and Methods
Apple has not disclosed who is behind the attacks, which spyware was used, or which vulnerabilities may have been exploited. The number of countries refers to the locations of notified users, not the number of victims or confirmed infections. Apple says it issues these warnings with a high degree of confidence. However, they do not automatically mean that every device has been successfully compromised. The company keeps its detection methods confidential to prevent attackers from adapting their techniques.
According to Apple, commercial spyware attacks can cost millions of US dollars and typically target a small number of individuals, often including journalists, activists, politicians, and diplomats. These attacks are sophisticated, short-lived, and therefore difficult to detect. In mid-October, Citizen Lab also provided the first technical evidence that commercial spyware can reach devices through targeted online advertising without any action by the victims. Apple has not linked this finding to the latest wave of warnings.
Warnings Appear on iPhone Lock Screens
Apple delivers its threat notifications in several ways: as alerts on the iPhone lock screen, through the Settings app, and by email to the address associated with the user’s Apple Account. A banner also appears when users sign in to the Apple Account website. Recipients should verify the notification directly on Apple’s website. Genuine threat notifications never ask users to install apps or configuration profiles, open files, or disclose passwords or verification codes.
Apple recommends that affected users update their devices and enable Lockdown Mode. This security feature restricts certain functions, including message attachments, some web technologies, incoming FaceTime calls from unknown contacts, and the installation of configuration profiles. Apple also directs affected users to Access Now’s Digital Security Helpline, which is available around the clock.
According to Apple, most users will never be targeted by these types of attacks.
(Editorial Team)
