Apple has started a new round of threat notifications, sent to iPhone users in 99 countries it believes were targeted by mercenary spyware. The wave began on 30 October and is separate from the one in August.
These alerts go to a small number of people, not the general public. Apple says the attacks cost enormous sums and are aimed at specific individuals, which is why journalists, activists, politicians and diplomats are the usual recipients. A notification means Apple detected targeting; it does not by itself prove a phone was successfully infected.
Security researcher Costin Raiu posted the text of the notice, which reads in part: “to date we have notified users in over 150 countries in total.” Apple adds that it does not attribute the attacks to any specific attackers or geographical regions, so no spyware product or country has been named. The 99 figure counts countries where recipients are located, not victims.
How the alerts reach you
Apple delivers threat notifications by Lock Screen alert, in Settings and by email to the address on the Apple Account. A banner also appears after signing in to the account on Apple’s website. If a message claims to be a threat notification, go to the account site yourself and look for that banner instead of tapping anything in the message. Apple says a genuine alert will never ask for a download, a profile install, a file to open, or any password or code.
What to do if you get one
Update the iPhone first, then switch on Lockdown Mode under Settings, Privacy & Security. The mode trims what the phone accepts from outside, such as attachments in Messages and certain web features, and Apple warns that some sites and features will then work differently. Apple points recipients to the Digital Security Helpline run by Access Now for expert help at any hour.
Apple has not said which countries are in this wave, and it has not published anything specific to Pakistan. For everyone else, Apple’s advice is the usual one: keep iOS current, protect the Apple Account with a strong password and two-factor authentication, and be careful with unexpected links.
