Loading story…
Apple sent a new round of threat notifications to users it believes were targeted by mercenary spyware capable of compromising iPhone, iPad, and Mac devices. The company said the latest alerts reached customers in 110 countries, and that it has now notified users in more than 150 countries since launching the program. The updated warning process includes a lock-screen push notification, an email, and a notice on the user’s Apple account page, reflecting a broader effort to ensure suspected victims recognize the seriousness of the targeting.
Apple’s guidance tells recipients to seek expert help and enable Lockdown Mode, a hardened security setting designed for people at elevated risk of targeted attacks. According to Apple, it has not observed a case in which a device was successfully compromised while Lockdown Mode was enabled. Researchers said the stronger notification flow can help victims identify spyware targeting earlier and may support wider investigations into abuse by governments and commercial surveillance vendors.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
Apple sent a new batch of threat notifications on Thursday to customers in 110 countries whom it believes were targeted by mercenary spyware capable of compromising iPhones, iPads, or Macs. The updated notification flow includes a lock-screen push alert, email, and an Apple account notification.
Apple published a support article explaining its threat notifications for users it believes were targeted by mercenary spyware and outlining protective steps such as enabling Lockdown Mode.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
19 references tracked. Mallory keeps watching after this page renders.
xakep.ru
Open sourcetechrepublic.com
Open sourcetechcrunch.com
Open sourcezdnet.fr
Open sourcetechcrunch.com
Open sourcesupport.apple.com
Open sourcesupport.apple.com
Open sourcesupport.apple.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Apple said it has not observed any successful mercenary spyware compromises on devices with **Lockdown Mode** enabled, nearly four years after launching the opt-in protection for users at elevated risk of targeted surveillance. Introduced in 2022, the feature hardens iPhones and other Apple devices by disabling or restricting functions that have repeatedly been abused in spyware campaigns, particularly the remotely reachable components used in **zero-click** exploit chains. Independent findings cited by Apple support the claim. Researchers at **Amnesty International** and **Citizen Lab** said they have not seen evidence of successful infections on Lockdown Mode-enabled iPhones, and Citizen Lab documented cases in which the feature blocked **Pegasus** and **Predator** spyware attacks. Google researchers also reported at least one spyware campaign that abandoned infection attempts after detecting Lockdown Mode, while security researcher Patrick Wardle said the feature’s aggressive reduction of attack surface makes it especially effective against exploit delivery methods used by mercenary spyware operators.
Jun 29, 2026
Multiple reports indicate that mercenary spyware operations have begun targeting not only traditional victims such as journalists and activists, but also the developers and security researchers who build and analyze surveillance tools. Apple issued high-confidence threat notifications to iOS exploit developers, warning them of government spyware targeting their devices. This marks a notable escalation in the mercenary spyware ecosystem, as attackers are now focusing on individuals with deep technical knowledge and access to sensitive information about exploit development. The commercial spyware market continues to thrive, with unpatched vulnerabilities fueling rapid innovation and deployment of new attack techniques. Security researchers have documented a record number of zero-day vulnerabilities exploited in the wild, many linked to commercial surveillance vendors. The targeting of exploit developers suggests a coordinated campaign within the cybersecurity community, highlighting the growing risks faced by those at the forefront of digital defense and offensive tool creation.
Jul 12, 2026
Hungary's National Cybersecurity Institute warned that **DarkSword**, a publicly available spyware and exploit kit for Apple devices, is targeting iPhones and iPads running `iOS 18.4` through `18.7` and corresponding `iPadOS` versions. The malware was described as easy to deploy after its code was released on a popular code-sharing platform, lowering the barrier for cyber-espionage activity. Once executed, DarkSword can steal contacts, messages, call history, authentication-related data, and other sensitive information, then exfiltrate it to attacker-controlled servers before deleting itself from the device to hinder detection. New reporting says the operation has since grown into a broad malicious web infrastructure spanning **180 web properties and 27 hosts**, using fake Apple sign-in pages, Apple-themed lures, and compromised websites to deliver a leaked six-vulnerability exploit chain and **GHOSTBLADE** data-theft modules. Researchers said successful compromise can expose keychain contents, iCloud data, Wi-Fi credentials, files, and Apple ID credentials, while operators rotate servers quickly and remove artifacts such as crash reports and `RemoteLog.log` to frustrate forensic analysis. Defenders were urged to apply Apple security updates, enable **Lockdown Mode** where patching is delayed, and monitor for recurring infrastructure fingerprints tied to the campaign.
Aug 4, 2026