Apple spyware alerts surge to unprecedented levels across 110 countries
Access Now and The Citizen Lab describe the volume of mercenary spyware warnings as the largest on record, prompting experts to urge users to enable Lockdown Mode.
Cybersecurity investigators have reported an unprecedented volume of Apple users receiving notifications regarding suspected mercenary spyware attacks across 110 countries. The surge in alerts, which began on Friday, has been described by experts as the largest batch issued by the technology giant to date, with reports extending to Ukrainian military personnel.
Mohammed Al-Maskati, director of the investigation team at Access Now, stated that the nonprofit received a record number of inquiries since the notifications were issued. Al-Maskati estimated that the volume of reports was between 30% and 40% higher than previous notification waves, noting that the increase included individuals who had received similar warnings in the past.
The scale of the incident has drawn attention from The Citizen Lab, a digital rights group with over 15 years of experience investigating government spyware. Senior researcher John Scott-Railton highlighted the geographic diversity of the public reports as unprecedented, suggesting that the visible cases likely represent only a fraction of total incidents. He described the situation as a clear indication of broader targeting activities.
Among those reporting the alerts is an anonymous Ukrainian Armed Forces soldier, who verified the notification with Apple after initially suspecting it was a scam. The soldier noted that while he was surprised to be targeted, he was aware of other military colleagues who had received similar warnings. The Computer Emergency Response Team of Ukraine (CERT-UA) did not respond to requests for comment regarding the prevalence of these alerts among its personnel.
Apple has expanded its notification methods this year to heighten awareness, now issuing alerts via iPhone lock screens, the Settings app, associated email accounts, and web login pages. Al-Maskati attributed part of the increased visibility to these new channels, which make it harder for users to ignore the warnings. Experts advise users to enable Lockdown Mode, a security feature that restricts device functionalities, noting that Apple has not identified any users with this feature enabled who have been hacked.
