This Spyware Warning From Apple Is Actually Real

Scams are a dime a dozen these days—so much so, you're pretty safe ignoring most of the messages you receive from unknown senders. But every now and then, an uncommon message isn't a scam, spam, or malicious in intent; in fact, sometimes, it's an official message from none other than Apple, warning you that you're being spied on.

As much as this situation sounds like classic spam, it's very much not: Apple actually did send alerts to users on Wednesday warning them they might be targeted by "mercenary spyware attacks." Two of the users Apple alerted were Ciro Pellegrino, an Italian journalist for Fanpage, and Eva Vlaardingerbroek, a Dutch right-wing activist. You can see an excerpt of the alert below:

This isn't the first time Apple has sent users this type of warning. In fact, the company sent a round of warnings to users back in July, complete with the same message as noted above. They did the same in April of 2024, as well.

According to an Apple support document on the subject, the company has sent alerts multiple times each year since 2021, now to over 150 countries in total. The specifics of the attempted attacks are limited, since Apple doesn't want to reveal how it is able to detect the risks to users. While that's understandable, it means users are left knowing they're likely the target of a spyware campaign, but without knowing from who or where.

To be clear, the vast majority of users receiving these alerts are not your everyday iPhone customers. Most of the users Apple believes are being targeted by spyware work in high-profile positions that attract attacks from state actors. Think politicians, journalists, activists, diplomats, etc.—people who expose secrets or have power that other people in power would like to stop. Bad actors spend millions of dollars to target these users in elaborate spyware campaigns, attempting to install malware on their devices in an effort to spy on location, data, and activity.

Perhaps the most notable spyware of this kind is Pegasus, which was created by the Israeli-based NSO Group to spy on a host of high-profile targets the government sees as "threats." What makes spyware like Pegasus particularly dangerous is it requires no action on the part of the target: Bad actors can infect iPhones and Androids with Pegasus silently in what's known as a "zero-click" attack, and track just about everything the target does on their smartphone.

What to do if you receive this alert

If you do receive one of these alerts, the first step is to ensure it's real. The company will send alerts via iMessage and email: iMessage alerts are sent from [threat-notifications@apple.com], while email alerts are from [threat-notifications@email.apple.com]. Before April of this year, Apple sent both from the @apple.com domain.

Even if you confirm the address, sign into appleid.apple.com and look for the threat notification at the top of the page. If Apple really sent you one, you'll see it here. Otherwise, assume the message is fake. Apple says its alert will never ask you to click a link, open a file, or install an app or profile, so if the "alert" asks you to do this, ignore it. These are classic tactics to trick users into installing the very malware a true alert would try to protect you from.

The company also recommends you reach out to the non-profit Access Now and use their Digital Security Helpline. While they won't be able to offer you specific advice about your situation, they will be able to walk you through general steps to secure yourself.

Whether you receive an alert, or your work involves one of these at-risk positions, Apple strongly encourages you to enable Lockdown Mode on your Apple devices. Lockdown Mode restricts many of the basic functions of your Apple devices, to plug potential holes bad actors can exploit to compromise those devices. This includes blocking things like message attachment types, web technologies in Safari, and incoming FaceTime calls. The feature also removes your location from shared photos, and stops configuration profiles from being installed on your device.

As Lockdown Mode limits the features of your iPhone or Mac, it's not something that most people should use on a daily basis. However, for those who may be targeted by bad actors, it can be a great line of defense. You can follow our guide here to enable Lockdown Mode on your Apple devices to protect yourself.

View the full article