‘Unprecedented’ number of Apple users received recent spyware alert, say investigators

An unprecedented number of Apple customers have reported receiving a recent threat notification alerting them to suspected spyware attacks targeting their devices, according to experts who investigate these types of incidents. 

Several people publicly and privately reported receiving Apple’s spyware alerts over the weekend, after Apple sent out a new wave of notifications on Friday alerting customers in 110 countries that they had been targeted with powerful spyware. 

From time to time, the technology giant sends these types of alerts in batches to customers that it believes have been either targeted or compromised with malware normally used by governments, which the company refers to as “mercenary spyware.” In the last few years, Apple says it has alerted people in more than 150 countries.

The latest batch appears to have been the largest yet, per one of the digital rights groups that Apple suggests victims of spyware reach out to for help.  

Mohammed Al-Maskati, the director of the Access Now team of investigators who review and investigate reports to the helpline, told TechCrunch that since Friday, they have received a record high number of people reaching out for help. This includes people who had already received threat notifications in the past. 

Al-Maskati said the number is around 30% to 40% more than the nonprofit’s investigators usually receive after Apple sends out new notifications. 

Cybersecurity firm iVerify also confirmed to TechCrunch that it was seeing an influx in threat notifications from Apple.

An unusually large number of people have also publicly reported receiving these notifications over the weekend as well, according to several social media posts.

One of them is a Ukraine Armed Forces soldier who said he is fighting the war against Russia. The soldier, who asked to remain anonymous to protect himself, said that he initially thought it was a scam, until he verified it with Apple.

“I was a bit surprised to be honest, I wouldn’t have thought I was important enough for them to target me like this. I am flattered though,” the soldier told TechCrunch. 

The soldier also said that he is aware of other people in Ukraine’s military who have received the same notification. “They were a bit worried,” he said. 

The Computer Emergency Response Team of Ukraine (CERT-UA) did not respond to TechCrunch’s request for comment, asking whether it was aware of other Ukrainians, particularly soldiers, receiving these notifications.  

John Scott-Railton, a senior researcher at The Citizen Lab, a digital rights group that has investigated government spyware attacks for more than 15 years, told TechCrunch that the reports show that spyware attacks may be more prevalent than people realize. 

“The scale and geographic diversity of public posts about receiving notifications are pretty unprecedented,” said Scott-Railton. “For every public notification like this, you can imagine there’s a huge notification iceberg that the public will never learn about. This is a clear indication that something bigger is going on.”

Both Al-Maskati and Scott-Railton said that the volume of people receiving the alerts could also be attributed to Apple’s new methods of alerting users.

Starting this year, Apple now notifies users on their iPhone lock screen, in their Settings app, via the email associated with their Apple account, and when users log in to their Apple Account on the web.

“Apple’s new notification method has helped raise awareness of the issue’s importance, making it harder for users to ignore,” Al-Maskati said.

Apple did not respond to TechCrunch’s request for comment. 

If you’ve received one of these notifications, take it seriously. If you are not a journalist, dissident, or human rights defender, there are other organizations that can help you investigate.

If you haven’t already, as Apple and experts suggest, turn on Lockdown Mode, a special security feature designed to make it harder to hack iPhones, iPads, and Mac computers. Apple has said that it is not aware of anyone who had Lockdown Mode enabled getting hacked.

Updated with additional data from iVerify.