【Pilar Coll】

Source：Pursuit Information Network Editor：Digital Culture Time：2025-06-26 13:12:06

Around this time just one week ago,Pilar Coll iPhone users in 92 counties received a bizarre notificationon their device.

"Apple detected that you are being targeted by a mercenary spyware attack that is trying to remotely compromise the iPhone associated with your Apple ID," read the notification. "This attack is likely targeting you specifically because of who you are or what you do. Although it's never possible to achieve absolute certainty when detecting such attacks, Apple has high confidence in this warning — please take it seriously."

Apple posted an announcementon its website giving basic details for why the company would generally send out a notification warning like this. However, the company has been relatively mum on the situation since. And it never quite disclosed the exact threat that spurred Apple to send out that notification to those users at that specific time.

You May Also Like

Now, a new report appears to have solved the mystery.

China-linked LightSpy spyware

The Apple news outlet Apple Insidernoticed a report by Blackberry— yes, the mobile phone company that was popular in the 2000s and has since pivoted into a cybersecurity firm — that appears to have gotten to the bottom of the spyware notification situation.

Mashable Light Speed Want more out-of-this world tech, space and science stories? Sign up for Mashable's weekly Light Speed newsletter. By clicking Sign Me Up, you confirm you are 16+ and agree to our Terms of Use and Privacy Policy. Thanks for signing up!

According to Blackberry, the spyware that iPhone users were warned about is called LightSpy, which is described in the report as a "sophisticated iOS implant."

The report points out that this is a concerning development because LightSpy was last seen used in a campaign during the 2020 political protests in Hong Kong. So, this latest attack appears to be a reemergence of LightSpy.

LightSpy is "a fully-featured modular surveillance toolset," according to Blackberry. The spyware can pull targets' private information, which includes pinpoint-accurate location data as well as data from messaging applications, text messages, phone call history, and web browser history. It can even create sound recordings from the device, including recording during VOIP calls.

LightSpy has been used by attackers to target individuals in Southeast Asia, including India, for the most part, which explains why those notifications were mostly received by iPhone users located in that general region. The messaging apps mentioned in Blackberry's report are among the most popular in that part of the world: QQ, WeChat, and Telegram. In addition, LightSpy can pull payment history from targets from the WeChat Pay service.

Blackberry believes this attack was once again perpetrated by China-based or native Chinese-speaking actors, as with previous LightSpy campaigns, and there's a potential for state-sponsored involvement as well.

The report recommends that users who have reason to be targeted, whether due to their employment or activism, utilize Apple's Lockdown Mode, which the iPhone-maker describes as a feature used to "protect devices against extremely rare and highly sophisticated cyber attacks."

Topics Apple Cybersecurity iOS iPhone

Previous：Commissioning Misleading Core i9

Next：'Thunderbolts*' mid

【Pilar Coll】

China-linked LightSpy spyware

Related Articles

Related Recommendations

Categories

Latest Articles

Popular Articles

Hot Recommendations

Featured Column

Quick Links

Quick Links