Apple issues fresh alerts about Pegasus-like spyware attacks to iPhone users in India

Apple has been sending these alerts to users in over 150 countries since 2021.

Apple has issued a new set of threat alerts to users in India and 97 other countries, warning them of potential "mercenary spyware attack" aimed at remotely compromising their iPhones.

“Mercenary spyware attacks, such as those using Pegasus from the NSO Group, are exceptionally rare and vastly more sophisticated than regular cybercriminal activity or consumer malware,” Apple said in the threat notification mail on July 10. Moneycontrol has reviewed a copy of the mail.

The same day Iltija Mufti, media adviser and daughter of former Jammu and Kashmir chief minister Mehbooba Mufti, and Pushparaj Deshpande, founder of Samruddha Bharat Foundation, said on the microblogging site X that Apple notified them of a possible hack on their phones.

Apple and the Ministry of Electronics and Information Technology (MeitY) didn’t respond to Moneycontrol’s queries.

The tech giant has been sending these notifications to users in over 150 countries since 2021.

In its July 10 notification, Apple also informed the targeted iPhone users that attacks such as those mounted on their devices “cost millions of dollars and are individually deployed against a very small number of people, but the targeting is ongoing and global”.

"The extreme cost, sophistication, and worldwide nature make mercenary spyware attacks some of the most advanced digital threats in existence today. As a result, Apple does not attribute the attacks or the notice you’re receiving to any specific attackers or geographical regions," the notification said. The company relies solely on "internal threat-intelligence information and investigations to detect such attacks", it added.

In the past, such notifications have triggered a political storm, with some opposition leaders, activists and journalists accusing the government of spying on its opponents. The matter even reached the Supreme Court. A court-appointed technical expert committee could not find Pegasus spyware in the mobile phones that were handed in for a forensic examination.

In April, the Indian Computer Emergency Response Team (Cert-In), the country's central cybersecurity agency, identified numerous vulnerabilities in Apple’s operating systems for iPhones and iPads, particularly in key applications like the Safari web browser.

Cert-In highlighted that earlier versions of the Safari browser, specifically those before version 17.4.1, and iOS and iPadOS versions prior to 17.4.1, had flaws that could potentially enable attackers to execute arbitrary code on targeted devices.

Also read: Microsoft, Apple drop OpenAI board plans as scrutiny grows