Apple's biggest spyware alert wave reached users in 110 countries
The August 13 wave is the largest in the program's history, and the first to put the warning on the Lock Screen itself.
The largest mercenary spyware warning wave Apple has sent, and the first that shows up on the Lock Screen.
On August 13, Apple sent its largest wave of mercenary spyware threat notifications yet, reaching users in 110 countries. Investigators who handle the aftermath call the scale unprecedented, TechCrunch reported: Access Now's helpline saw 30 to 40 percent more people asking for help than after any previous wave.
What changed in delivery
For the first time, the warning appears on the Lock Screen, not only in Settings, email, and the Apple Account page. John Scott-Railton of Citizen Lab, who has tracked these campaigns for a decade, flagged the geographic spread of public reports as the widest he has seen. Apple's own documentation describes the notification paths and is the reference for checking whether an alert is real: sign in at account.apple.com, and the warning shows there too.
Mercenary spyware is the commercial kind sold to state actors: tools in the Pegasus and Predator class, priced per target, used against journalists, activists, diplomats, and politicians rather than at random. Apple has sent these notifications since 2021, but a 110-country wave says something changed in the targeting economics, the detection, or both. Apple does not say which, and that silence is deliberate: detail helps the vendors test against detection.
If one lands on a phone you know
- Verify it is real by signing in at account.apple.com, never through a link in a message.
- Update iOS immediately, then enable Lockdown Mode.
- Get expert help before wiping anything: Access Now's Digital Security Helpline is the route Apple itself points to, and a factory reset destroys the forensic evidence.
Why a build studio cares
Some of the people who use the products we build are exactly the people these alerts go to, and an app that breaks under Lockdown Mode quietly excludes them. Lockdown Mode disables link previews, some web fonts, and JIT in ways that break sloppy assumptions, and the people who need your app to work under it have the least room for error.
Next step: turn on Lockdown Mode on a test device and run your app's core flows end to end. Fix what breaks. If you want that pass done and documented for your product, write to us at hello@gattyworks.com.