Investigators Uncover Unprecedented Surge in Spyware Alerts for Apple Users

An unprecedented number of Apple users have reported receiving recent alerts about potential spyware threats aimed at their devices, as reported by experts in this field.

Many users began receiving Apple’s spyware alerts over the weekend following a fresh wave of notifications issued by the company on Friday. This alert notified customers in 110 countries that their devices might have been targeted by advanced spyware.

Periodically, the tech giant sends these alerts in batches to customers it suspects have been targeted or compromised by malware, often used by government entities, which Apple terms “mercenary spyware.” Apple claims to have issued warnings to individuals across more than 150 countries in recent years.

This latest batch of notifications is reportedly the largest to date, according to a digital rights organization that Apple directs victims of spyware to for assistance.

Mohammed Al-Maskati, who leads the Access Now team that investigates these issues, told TechCrunch that they have observed an extraordinary influx of individuals seeking help since Friday, including those who had received alerts in the past.

Al-Maskati mentioned that the requests for assistance are roughly 30% to 40% higher than what the nonprofit typically encounters after new Apple notifications are sent out.

Cybersecurity company iVerify also confirmed to TechCrunch that they have noticed a rise in Apple’s threat notifications.

A significant number of users have reported receiving these notifications over the weekend, as seen in multiple posts across social media.

Among those affected is a soldier from the Ukrainian Armed Forces currently involved in the conflict with Russia. He requested anonymity for safety reasons, noting that he initially dismissed the notification as a scam until he verified its validity with Apple.

“Honestly, I was a bit surprised; I didn’t think I was significant enough to be targeted like this. Still, it’s a little flattering,” he shared with TechCrunch.

The soldier also mentioned that other military personnel in Ukraine have received similar notifications. “They were somewhat worried,” he commented.

The Computer Emergency Response Team of Ukraine (CERT-UA) did not respond to TechCrunch’s inquiry regarding whether they were aware of additional Ukrainians, especially military personnel, receiving such notifications.

John Scott-Railton, a senior researcher at The Citizen Lab—a digital rights organization that has been investigating government spyware attacks for over 15 years—told TechCrunch that these reports indicate spyware attacks may be more prevalent than commonly perceived.

“The volume and geographical spread of public reports about these notifications are truly unprecedented,” Scott-Railton stated. “For every public notification, it is reasonable to infer that there exists a much more extensive ‘notification iceberg’ that remains unseen. This indicates that something significant is happening.”

Both Al-Maskati and Scott-Railton suggested that the increase in individuals receiving alerts may also relate to Apple’s updated notification methods.

This year, Apple began notifying users via their iPhone lock screens, through the Settings app, via the email associated with their Apple accounts, and when logging into their Apple Account on the web.

“Apple’s revised notification method has heightened awareness about the severity of the issue, making it harder for users to overlook,” Al-Maskati observed.

Apple did not respond to TechCrunch’s request for comment.

If you have received such a notification, take it seriously. If you are not a journalist, dissident, or human rights advocate, there are other organizations that can assist you in your inquiry.

As recommended by Apple and security experts, consider enabling Lockdown Mode, a specialized security feature designed to enhance defense against hacking attempts on iPhones, iPads, and Mac computers. Apple has stated that it is unaware of any user with Lockdown Mode activated who has suffered a breach.

Updated with additional data from iVerify.