Apple Alerts Users in India and 91 Nations to Potential ‘Mercenary Spyware’ Threat

Apple has distributed new alerts to certain users in India and 91 other nations, cautioning them that their iPhones may have been targeted by “mercenary spyware,” which includes the contentious Pegasus malware developed by the Israeli NSO Group.

Apple hasn’t assigned blame for the recent surge of attacks to any specific entity. Similarly, in October of last year, it had issued a comparable warning to opposition leaders from various political parties — including Congress’s Shashi Tharoor, AAP’s Raghav Chadha, and TMC’s Mahua Moitra — alerting them to the possibility of a “potential state-sponsored spyware attack” on their iPhones. Following government pressure, the company clarified afterward that it does not assign the threat notifications to any particular state-sponsored attacker.

Apple Notification emails

The threat notification emails were dispatched to affected users in India at approximately 12:30 am IST on Thursday, April 11th. The exact number of recipients who received the notification from Apple remains uncertain. Additionally, the email highlights the NSO Group’s Pegasus spyware, indicating that such tools are consistently utilized to target individuals worldwide.

The subject line of the threat notification reads: “ALERT: Apple has identified a targeted mercenary spyware attack against your iPhone,” as seen by The Indian Express. The notification email states: “Apple has detected that you are the target of a mercenary spyware attack attempting to remotely compromise the iPhone linked to your Apple ID -xxx-. This attack is likely directed at you individually due to your identity or activities. While achieving absolute certainty in detecting such attacks is not always possible, Apple expresses strong confidence in this warning — it is crucial to take it seriously.”

“Mercenary spyware attacks, such as those using Pegasus from the NSO Group, are exceptionally rare and vastly more sophisticated than regular cybercriminal activity or consumer malware. These attacks cost millions of dollars and are individually deployed against a very small number of people, but the targeting is ongoing and global,” Apple said in its threat notification

The company urged users to exercise caution when encountering any links, advising against opening attachments or links from unfamiliar or unexpected sources. However, the company stated its inability to disclose further details regarding the reason for sending the threat notification. This decision was made to prevent mercenary spyware attackers from adjusting their tactics to evade detection in subsequent incidents.

Apple has additionally revised its support page to offer guidance for users who might have been potential targets of the mercenary spyware attack. “Apple threat notifications are crafted to notify and aid users who may have been individually targeted by mercenary spyware attacks, presumably due to their identity or activities,” stated the iPhone manufacturer.