The Digital Security Digest, by Freedom of the Press Foundation (FPF), is a weekly newsletter with security tips that keep you, your sources, and your devices safe. If someone shared this newsletter with you, please subscribe here.

In apparent spike, Apple alerts wave of users to mercenary spyware

Apple threat notification alert on an iPhone’s lock screen
Credit: Apple

If you receive one of Apple’s threat notifications, your Apple device has likely been targeted with spyware sold with the help of private vendors to governments around the world. In recent days, Apple has reportedly issued an uncommon surge of warnings to users that their device may have been targeted in this way.

In a support post, Apple says, “Though deployed against a very small number of individuals — often journalists, activists, politicians, and diplomats — mercenary spyware attacks are ongoing and global.” According to TechCrunch, Apple sent “an unusually large number” of threat notifications on Friday. Access Now, as well as iVerify, a cybersecurity firm, have both received a spike in requests for security support in relation to these notifications.

While we don’t know who is responsible for the spike, one Ukrainian soldier speaking to TechCrunch reported receiving the alert and said that “he is aware of other people in Ukraine’s military who have received the same notification.”

What you can do

It’s great that Apple provides these notifications, and we hope more companies will do the same to notify their users. Because mercenary malware vendors, to avoid detection, have to rebuild exploits every time they are patched in security updates, attackers deploy their most sophisticated malware sparingly. But because journalists are special and worthy of a data breach, we encourage you to take steps to protect yourself even if you never see one of these alerts.

  • Try Lockdown Mode. Don’t wait until you receive a threat notification to try out Apple’s best security settings on your iPhone, iPad, or MacBook. Lockdown Mode disables some features on your devices that are known vectors for delivering spyware. Earlier this year, Apple said that it is aware of no cases where a customer with Lockdown Mode enabled has experienced a subsequent breach. To learn more about how it works, and whether it’s the right fit for you, read our advice column on Lockdown Mode. Android users should also look into a similar feature called Advanced Protection.
  • If you receive a threat notification, get support. Apple strongly recommends getting expert help, such as from Access Now’s 24/7 digital security helpline, for assistance from researchers with experience investigating these attacks.
  • Know the “source of truth” for threat notifications. Apple cautions that threat notifications will not ask you to open links, install anything, or provide any login information. This is a friendly way of saying, if you receive a threat notification asking you to take an action within the message, be on alert, because it’s a fraud. To double- check, you can log into your account at account.apple.com, and if you have a threat notification, it will appear as a prominent banner at the top of the account page. These notifications will also be sent to your iPhone and to your email from [email protected].
Threat notification banner on Apple Account landing page
Credit: Apple

Updates from our team

  • IndieWire highlighted our digital security training series for filmmakers, offered in collaboration with friends at Field of Vision. Check it out. We’ve already kicked off the training, but there’s even more to come. The series covers risk assessment, secure communication, travel safety, footage protection, digital footprint management, and artificial intelligence in filmmaking. So, if you are a filmmaker or want to share this with a filmmaker in your life, we hope you’ll sign up here.
  • Our chief security programs officer, Harlo Holmes, will be working alongside the International Women’s Media Foundation and The Media Resilience Network on a series of workshops to help media-makers secure their footage while out in the field. Join us starting on Sept. 23 at noon EDT. Sign up here.

Our team is always ready to assist journalists with digital security concerns. Reach out here, and stay safe and secure out there.

Best,
Martin

–

Martin Shelton
Deputy Director of Digital Security
Freedom of the Press Foundation