Apple sends new ‘Threat Notification’ alerts over mercenary spyware attacks

You're not alone if you just received an "Apple Threat Notification" saying it detected a "mercenary spyware attack targeted at your iPhone."

Apple confirmed to BleepingComputer that it sent a new batch of threat notifications on August 13 to targeted users in 110 countries.

Some users on Reddit also reported receiving the alerts, but the feature itself is not new.

Apple sent a new batch of alerts to users on August 13
Source: Reddit

Apple has been sending these threat notifications multiple times a year since 2021, when it detects highly targeted mercenary spyware attacks.

It's also worth pointing out that Apple does not identify the spyware behind individual alerts, so there's no evidence that today's notifications are specifically related to Pegasus.

However, Apple itself cites NSO Group's Pegasus as an example of mercenary spyware historically associated with this type of attack, and forensic investigations into previous Apple threat notifications have confirmed Pegasus infections in some cases.

In a support document, Apple previously confirmed it sends threat notifications to users in more than 150 countries after detecting highly targeted mercenary spyware attacks against specific iPhone users.

The list of potential targets includes journalists, activists, politicians, and diplomats, who have historically been among those targeted by this type of spyware.

These attacks are expensive, highly sophisticated, and typically aimed at a very small number of people.

"Mercenary spyware attacks cost millions of dollars and often have a short shelf life, making them much harder to detect and prevent," Apple explained.

"The vast majority of users will never be targeted by such attacks."

The company does not attribute individual alerts to a specific government, company, or geographical region.

Apple says threat notifications should be taken seriously

Apple relies on its own threat intelligence and investigations to identify suspected mercenary spyware activity, which means these notifications are "high-confidence alerts" and not just a regular warning.

"Although our investigations can never achieve absolute certainty, Apple threat notifications are high-confidence alerts that a user has been individually targeted by a mercenary spyware attack, and should be taken very seriously," Apple noted.

"We are unable to provide information about what causes us to issue threat notifications, as that may help mercenary spyware attackers adapt their behavior to evade detection in the future."

Apple also told BleepingComputer that it has updated the threat notification experience to make it easier for recipients to find important information and follow recommended steps to protect their accounts and devices.

If Apple detects this activity, it sends an email and iMessage notification to the email addresses and phone numbers associated with the user's Apple Account.

The emails are usually from [email protected], and Apple also warns users about fake versions of these alerts.

How to verify if a threat notification is real

You can verify whether a threat notification is genuine by opening account.apple.com. If Apple sent you a threat notification, it will appear at the top of the page after you're logged in.

Apple's threat notification emails will not ask you to click a link, open a file, install an app or profile, or provide an Apple Account password or verification code.

If you believe you've been affected, you should enable Lockdown Mode, keep your devices updated with the latest software, and reach out to a cybersecurity expert.

Apple recommends taking these alerts seriously because receiving one means it has high confidence that the user was individually targeted.

Update 1: Article updated with a statement from Apple confirming that threat notifications were sent on August 13 to targeted users in 110 countries.