Apple’s Spyware Issue with iPhones Is Getting Serious. This Is What You Need to Know

Apple has detected spyware attacks on people in over 150 countries. Knowing if your device is infected can be difficult—but there are a few precautions you can take to protect yourself.

In April, Apple issued warnings to iPhone customers in 92 countries, notifying them that they had been targeted with spyware. “Apple detected that you are being targeted by a mercenary spyware attack that is trying to remotely compromise the iPhone associated with your Apple ID,” the message said.

Weeks later, little is known about the recent iPhone attacks. Former smartphone giant Blackberry, now a security firm, has released research indicating they are linked to a Chinese spyware campaign dubbed “LightSpy,” but Apple spokesperson Shane Bauer says this is incorrect, and researchers at security firm Huntress say the variant Blackberry analysed was a macOS version rather than iOS.

Apple’s warnings in April were not the first time it had given such notices. Since 2021, the iPhone maker has sent out alerts to customers in more than 150 nations, as spyware continues to target high-profile figures worldwide.

Nation-state opponents can weaponize spyware, but this is rare and expensive. Its use is often directed at a very narrow group of persons, such as journalists, political dissidents, government employees, and corporations in certain industries.

Furthermore, Apple claims that its Lockdown Mode feature may effectively guard against threats. “As we have said before, we are not aware of anyone using Lockdown Mode being successfully attacked with mercenary spyware,” says Bauer. Still, spyware can be exceedingly hazardous to individuals who are targeted and caught off guard.

Zero – Click Attacks

Hackers may hear anything you write on your smartphone, including messages sent through encrypted apps like Signal and WhatsApp, thanks to spyware. Additionally, they have the ability to gather passwords, track your position, and obtain data from apps.

Spyware used to be distributed by phishing, which required the victim to download an image or click on a link. These days, spyware can be installed on your device instantly through iMessage or WhatsApp images in “zero-click attacks.”

Hackers can hear anything you write on your phone, including messages sent through encrypted apps like Signal and WhatsApp, thanks to spyware that grants them access to the microphone. They are also capable of gathering passwords, tracking your location, and extracting data from apps.

In the past, phishing was used to distribute spyware, tricking the victim into clicking on a link or downloading an image. In modern times, it can be distributed by “zero-click attacks” that install spyware on your device automatically through an iMessage or WhatsApp image.

The victim only has to receive an iMessage with an attachment that contains a zero-click exploit. According to Boris Larin, principal security researcher at Kaspersky’s Global Research & Analysis Team, “without any further interaction, the message triggers a vulnerability, leading to code execution for privilege escalation and providing full control over the infected device.”

He claims that the message is immediately erased as soon as the attacker makes their presence known on the device.

What You Need To Do

You have few options if you believe you are being targeted by spyware. Start by turning on Apple’s Lockdown Mode, which can prevent your iPhone from ever becoming infected in the first place by disabling several features while still being surprisingly useful. Second, there are helplines like Amnesty International’s Security Lab and Access Now’s Digital Security Helpline that can assist you in eliminating spyware from your device if you think it has already been infected.

Spyware detection can be quite difficult, and it is nearly impossible to find an infection on your own when dealing with sophisticated spyware like Pegasus.

Unusual behaviour such as sudden shutdowns, high data usage, or rapid battery draining could be an indication of a less sophisticated form of spyware, according to Javvad Malik, lead security awareness advocate at security training company KnowBe4. Although some programmes make the claim to be able to identify spyware, he argues that their efficacy varies and that reliable detection frequently requires expert aid.

Battery drain, according to Chris Hauk, consumer privacy advocate at Pixel Privacy, is a reliable sign that your device is infected with simple spyware. He claims that “most spyware has not been developed to run efficiently.”

Should you suspect that you are the victim of low-grade spyware, you should also be alert for uninstalled apps, forced browser redirects brought on by hijacked browsers, and modifications made to their default search engine or browser settings.

The Kaspersky team unveiled a technique earlier this year to identify telltale signs of infection from advanced iOS spyware including Pegasus, Reign, and Predator. According to the security group, it may be useful as Pegasus infections leave behind evidence in the unexpected system log, Shutdown.log, which is kept in the sysdiagnose archive of iOS devices. However, the only surefire way to find a sophisticated spyware infection is to cooperate with experts like those at Access Now and Amnesty. Maintaining the possibly contaminated gadget for expert examination is also the recommended course of action.

Making sure you restart your device at least once a day is another precaution you can take to keep it safe. According to Larin, “this necessitates that attackers repeatedly reinfect, increasing the chances of detection over time.” However, keep in mind that this just removes simple spyware from your system; advanced malware may still be present.

You can also turn off FaceTime and iMessage if you think you could be a target and lessen the chance that zero-click attacks will happen to you. In addition, Adam Price, a cyber threat intelligence analyst at Cyjax, advises you to avoid clicking on links in emails or other messages and to keep your device updated with the most recent software.