Apple sends out warnings to targets of mercenary spyware attacks
Apple has issued a new round of alerts to users it believes have been individually targeted by mercenary spyware, according to Citizen Lab researcher John Scott-Railton. The warnings matter because such tools, including Pegasus, are commonly linked to state-backed surveillance of journalists, activists, politicians and diplomats, and are difficult to detect or stop.
Apple says its alerts are high-confidence assessments, though it cannot guarantee absolute certainty or disclose its detection methods without helping attackers evade them. Receiving an alert does not necessarily mean data has been compromised, but indicates activity consistent with a targeted attack; Apple recommends enabling Lockdown Mode and seeking specialist help, including Access Now’s Digital Security Helpline.
In short
- Apple issued fresh alerts over suspected mercenary spyware targeting.
- Targets may include journalists, activists and political figures.
- Apple recommends Lockdown Mode and expert security support.
Steelman: both sides, in good faith
The strongest fair case each way — we don't pick a winner.
The case for
Apple's warnings provide critical information to individuals targeted by sophisticated state-sponsored spyware, enabling them to take protective action. Journalists, activists, and political figures face documented threats from tools like Pegasus, and early warning—even with inherent uncertainties—allows vulnerable users to enable security features and seek specialist support. The alternative, withholding knowledge of targeted attacks, leaves users defenceless against genuine state threats.
The case against
Significant concerns limit the programme's effectiveness. Apple cannot disclose detection methodologies without helping attackers, making it impossible for independent verification of whether warnings accurately identify actual threats or generate false positives causing unnecessary distress to already-targeted individuals. Furthermore, Apple's surveillance-detection systems necessarily involve monitoring network activity to identify spyware, raising fundamental questions about what data Apple itself collects and whether users fully consent to Apple's own monitoring in order to detect others' surveillance.
Explained simply
Mercenary spyware is surveillance software sold by private companies, often to governments. Tools such as Pegasus can be installed on a person’s phone to access messages, calls and other data, sometimes without obvious signs.
Journalists, activists, politicians and diplomats have been among those targeted. Apple says its alerts reflect a high-confidence assessment, but cannot be certain or share the details behind its detection methods.
An alert signals activity consistent with a targeted attack, but does not by itself prove that someone’s data has been accessed. Apple recommends extra protections and specialist advice for people who receive one.