Mac Security · High-Risk Users & Lockdown Mode · Lesson 2 of 5

Spyware Threats in Plain Words

What mercenary spyware is, who it targets, and how Apple warns people.

Mercenary spyware explained

Spyware is software that secretly watches what you do on a device. It can read messages, track your location, and turn on the microphone or camera.

Mercenary spyware is the most advanced kind. Private companies build it and sell it, mostly to governments. A mercenary is someone who works for whoever pays. These companies do the same with their tools.

In Mobile Track 6 you met Pegasus, one famous example. The same kind of threat can aim at a Mac.

Mercenary spyware often uses a zero-click exploit. An exploit is a trick that uses a hidden flaw in software. Zero-click means you don't have to tap or open anything. A message can arrive, and the attack runs on its own.

That sounds scary. Here is the good news: almost nobody is a target.

• It is very expensive. One attack can cost a huge amount of money.
• Each use risks discovery. When researchers catch it, the company loses a costly secret flaw. So buyers save it for a small number of people they care about a lot.
• The targets are specific. Journalists, activists, human rights workers, political figures and the people close to them.

If you are not in a group like that, your real risks are the everyday ones you already know: phishing, fake pop-ups, weak passwords and old software.

Some simple habits help against both kinds of threat:

• Install updates quickly. Updates fix the flaws spyware depends on.
• Restart now and then. Some spyware doesn't survive a restart, so attackers must break in all over again.
• Use Lockdown Mode if you might be a target. It has blocked real attacks.

When Apple sends a warning

When Apple believes someone has been targeted by mercenary spyware, it may send an Apple threat notification. This is a warning that you may have been targeted because of who you are or what you do.

Apple delivers threat notifications in these ways:

• A banner at the top of the page when you sign in at account.apple.com, Apple's website for your Apple Account.
• An email to the addresses on your Apple Account, from threat-notifications@email.apple.com.
• On an iPhone, an alert on the Lock Screen and in Settings.

Scammers know these warnings exist, so they send fake ones. A real Apple threat notification never asks you to:

• click a link
• open a file
• install an app or a profile
• give your Apple Account password or a verification code, by email or phone

To check a warning, don't click anything in the email. Open a browser, type the Apple Account address yourself, and sign in. If Apple sent a real notification, it appears clearly at the top of the page.

If it's real, Apple suggests:

• Turn on Lockdown Mode on your devices.
• Get expert help. Apple points people to the Digital Security Helpline run by Access Now, a nonprofit. It is open 24 hours a day, every day, through its website.
• Keep every device updated.

Apple can't tell you exactly what caused the warning, because that could help attackers hide. Take it seriously, stay calm, and get help from people who do this work every day.