Apple Boosts Spyware Alerts For Mercenary Attacks

Apple has updated its documentation related to its warning system for mercenary spyware threats, now specifying that it alerts users when they may have been individually targeted by such attacks.

The revision points out companies like NSO Group, known for developing surveillance tools like Pegasus, which state actors often use for targeted attacks on individuals such as journalists, activists, politicians and diplomats. 

In a blog post published on Wednesday, Apple highlighted the global and sophisticated nature of these attacks, which are costly and complex.

The update marks a shift in the wording from informing and assisting users targeted by state-sponsored attackers to specifically addressing mercenary spyware threats.

“It’s really important to recognize that mercenary spyware, unlike others, is deliberately designed with advanced capabilities, including zero-day exploits, complex obfuscation techniques, and self-destruct mechanisms, making it highly effective and hard to detect,” explained Krishna Vishnubhotla, vice president of product strategy at Zimperium.

According to recent reports, Apple sent threat notifications to iPhone users in 92 countries, coinciding with the support page revision.

While Apple began sending threat notifications in November 2021, it refrained from attributing the attacks or notifications to any particular threat actor or region. 

This development now aligns with global efforts to counter the misuse of commercial spyware, as evidenced by a coalition of countries, including the US, working to develop safeguards against invasive surveillance technology.

Moreover, a recent report by Google’s Threat Analysis Group (TAG) and Mandiant shed light on the exploitation of zero-day vulnerabilities in 2023, with commercial surveillance vendors being responsible for a significant portion of these exploits. 

These vulnerabilities targeted web browsers and mobile devices, underscoring the increasing reliance of threat actors on zero days for evasion and persistence.

Read more on zero-day flaws: A Guide to Zero-Day Vulnerabilities and Exploits for the Uninitiated

Google’s report also emphasized the ongoing need for security investments to mitigate such threats, as threat actors continue to bypass security measures to infiltrate target devices.