Key Phone and App Features to Protect Against Spyware

Spyware attacks targeting journalists, activists, and political dissenters are on the rise. In early 2025, WhatsApp alerted around 90 individuals, predominantly journalists and civil society members across Europe, that they were being targeted by Paragon Solutions, an Israeli spyware company. A few months later, Apple sent out security alerts to a separate group of iOS users; forensic analysis indicated that two of these users, both journalists, had been compromised by Paragon’s Graphite spyware through a zero-click exploit—meaning they took no action to become vulnerable. Such incidents are no longer exceptions; they have become routine.

For more than 15 years, cybersecurity professionals have documented countless cases where state-sponsored hackers successfully accessed the devices of journalists, human rights advocates, critics, and political opponents.

These assaults use sophisticated, expensive, and discreet tools that enable hackers to infiltrate devices and install spyware, with smartphones being particularly targeted since they contain nearly all personal information regarding daily life.

Spyware provides its operators with nearly unrestricted access to a target’s device and information. Government agents are able to eavesdrop on phone conversations, intercept text messages, access photos, and even activate the camera and microphone to capture ambient audio. Additionally, spyware commonly tracks a user’s real-time location.

In response to these growing threats, major technology companies are bolstering user security. Significantly, Apple, Google, and Meta are rolling out opt-in features specifically designed to combat targeted spyware attacks.

Generally, these security features enhance protection, sometimes at the expense of certain everyday functionalities. While this may require some adjustments, my experience has shown that they are manageable and not overly disruptive.

Tech companies, cybersecurity professionals who have scrutinized spyware for years, and our team at TechCrunch recommend that individuals who suspect they may be targets of government surveillance due to their identity or actions should adopt these protective measures. Even for those not currently under threat, these security features can prevent data breaches.

While no security solution is infallible, adopting a proactive approach towards vulnerabilities is crucial. Spyware developers are continually finding new ways to penetrate phones and services, and software developers must adapt in response. This cycle is ceaseless.

However, this doesn’t mean that implementing these features isn’t worthwhile; they have proven effective.

“These features are free, easy to enable, and currently represent the best defense against sophisticated spyware,” stated Runa Sandvik, a security expert dedicated to protecting journalists and vulnerable communities for over a decade. “If these features disrupt your activities, you can easily turn them off, making it low-risk to try them out.”

Here’s a summary of these features and how to activate them.

Apple’s Lockdown Mode

Apple’s Lockdown Mode is accessible on all Apple devices, including iPhones. According to Apple, enabling Lockdown Mode means “your device will not function as it typically does.” In exchange for this inconvenience, you gain enhanced security.

Data indicates that Lockdown Mode has been successful in the past. Citizen Lab reported it thwarted an attack from NSO Group’s Pegasus software. Most recently, Apple confirmed that no successful breaches had occurred on any Apple device with Lockdown Mode active.

Here’s what happens when Lockdown Mode is turned on:

• Attachments received via iMessage other than select images, videos, and audio are automatically blocked.
• iMessage will restrict links and previews, displaying them as non-link web addresses (but you can copy and paste them into Safari or another browser if needed).
• Certain fonts, images, and web technologies are limited while browsing in Safari.
• Incoming FaceTime calls are blocked unless you’ve communicated with that person in the last 30 days.
• Screen sharing, SharePlay content sharing, and Live Photos are disabled.
• Incoming invitations for Apple services are blocked unless you’ve previously invited that individual.
• The Focus feature “and related status will not function as expected.”
• Game Center is disabled.
• Location data is removed from shared photos.
• “Shared albums are erased from the Photos app; new Shared Album invitations are blocked.”
• You must unlock your device to connect it to accessories or a computer. When connecting to a Mac with Apple processors, both the computer and connection must be authorized with a passcode.
• Automatic connections to public or open Wi-Fi networks are prohibited; any previously connected unsecure Wi-Fi networks are disabled once Lockdown Mode is turned on.
• Your phone will be unable to connect to 2G or 3G cellular networks.
• Configuring profiles or enrolling the device in Mobile Device Management is not permitted.

To activate Lockdown Mode, go to Settings, then Privacy & Security, and scroll down to Lockdown Mode. Your Apple device will reboot after activation.

I’ve been using Lockdown Mode for years. Initially, I faced a few website issues, but they haven’t troubled me for a long time. Moreover, you can disable Lockdown Mode for specific websites or apps without completely turning off the feature. I’ve acclimated to its peculiarities.

Google’s Advanced Protection Program

Initiated in 2017, Google’s Advanced Protection Program is tailored to strengthen your Google account against various malicious threats.

The Advanced Protection Program includes these features:

• Limits third-party applications and services from accessing your Google account unless specifically authorized.
• Enables “Deep Gmail Scans” to thoroughly inspect incoming emails for phishing attempts and harmful content.
• Engages Google Safe Browsing in Chrome, alerting users about risky sites or downloads.
• On Android, only apps from recognized app stores can be installed.
• If an unauthorized login attempt occurs, Google requires additional verification steps to verify your identity.

To enable Advanced Protection, visit its official page and select “Get Started.” You’ll need to log into your Google account and follow the provided instructions.

Initially, you will need to add a physical security key (or a software passkey) as an additional verification step alongside your passwords. Additionally, you need to link a recovery phone number and email to your account, or use a backup security key or passkey.

Android’s Advanced Protection Mode

Launched last year, likely inspired by Apple’s Lockdown Mode, Android’s Advanced Protection Mode introduces similar security features to Google’s mobile operating system.

This mode provides the following security enhancements:

• Activates Google Play Protect to shield against malware and unwanted apps while reviewing applications for harmful behaviors.
• Restricts installations from unknown sources, preventing updates to apps not obtained through recognized channels.
• Enables Memory Tagging Extension (MTE) on supported devices to offer added protection against specific vulnerabilities.
• Locks the device automatically if it detects suspicious activity indicative of theft, based on data from motion sensors, Wi-Fi, and Bluetooth.
• The device locks itself if it remains offline for a considerable time.
• If it stays locked for 72 hours, the device will reboot, complicating data access through law enforcement tools like Cellebrite devices.
• Blocks USB connections while the device is locked.
• Google examines for “unwanted and potentially dangerous messages.”
• Links received via the Messages app from unknown numbers are flagged.
• Restriction on connecting to 2G networks.
• Google identifies spam callers.
• You gain the option to screen incoming calls and automatically dismiss spam calls (availability may vary by region).
• Activates Android Safe Browsing to protect against malicious websites.
• Chrome mandates HTTPS encryption for all websites.
• Disables certain JavaScript functionalities, reducing the browser’s potential weaknesses.
• Optional Intrusion Logging can be activated to assist researchers in studying spyware attacks.

To turn on Advanced Protection Mode on your Android device, navigate to Settings, then Security and Privacy, select Other Settings, tap Advanced Protection, and then press Device Protection.

WhatsApp’s Strict Account Settings

WhatsApp has over 3 billion users, many of whom are at risk from well-funded government entities.

The hacking tools targeting WhatsApp are highly lucrative, with exploits valued at millions; the impact is evident. In 2019, WhatsApp prevented an attack linked to NSO Group that impacted around 1,200 accounts. Previously, another operation compromised approximately 90 users in Europe.

In response, WhatsApp introduced Strict Account Settings earlier this year, an opt-in feature that activates various privacy and security measures based on the operating system.

For both Android and iOS, Strict Account Settings enable the following protections:

• Two-step verification.
• Security notifications that alert users if a contact changes their phone number, reinstalls WhatsApp, or if an unauthorized login is detected.
• Attachments and media (images and videos) from unknown senders are blocked automatically.
• Link previews are disabled.
• Calls from unknown numbers are silenced.
• Your IP address is hidden during calls.
• Profile information and activities, like last seen status or profile photo, are invisible to non-contacts or individuals outside a predefined group.
• Only established contacts or members of predefined groups can add you to group chats.

To enable this feature, use your primary device, navigate to Settings, then Privacy, and scroll down to Advanced to activate it.