[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f8bv1eHMCkKOdN4K0oY-SyXug18419YrFMSOBF2TeWGE":3},{"article":4,"iocs":46,"watch_terms":47,"solutions":48,"lesson":143},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":23,"category":24,"article_tags":28},"303fb8b9-0c77-4b5f-a0b3-36e1c0488497","Apple warns users in 99 countries of mercenary spyware","apple-warns-users-in-99-countries-of-mercenary-spyware-3aca88","Apple does not attribute attacks or the notices to specific malicious actors or geographical regions, the notification said, due to the “extreme cost, sophistication, and worldwide nature of mercenary spyware attacks [which] make them some of the most advanced digital threats in existence today.”","Apple has issued threat notifications to users in 99 countries suspected of being targeted by mercenary spyware. The company did not attribute the attacks to specific actors due to their sophistication and global reach. Targets include journalists, with one recipient suggesting the targeting is linked to their reporting on sensitive geopolitical events.","Apple warns users in 99 countries of mercenary spyware attacks.","https:\u002F\u002Ftherecord.media\u002Fapple-warns-users-99-countries-mercenary-spyware","http:\u002F\u002Fcms.therecord.media\u002Fuploads\u002Fapple_iphone_93dc66938c.jpg","2026-11-02T14:42:00+00:00","2026-11-02T15:00:07.835161+00:00",8,[17,20],{"name":18,"type":19},"iPhone","product",{"name":21,"type":22},"mercenary spyware actors","threat_actor","e7b231c8-5f79-4465-8d38-1ef13aea5a14",{"id":23,"icon":25,"name":26,"slug":27},null,"Threat Intelligence","threat-intelligence",[29,34,39,44],{"category":30},{"id":31,"icon":25,"name":32,"slug":33},"614132b8-5837-4952-b8b5-c6c9a32a1d85","Privacy","privacy",{"category":35},{"id":36,"icon":25,"name":37,"slug":38},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":40},{"id":41,"icon":25,"name":42,"slug":43},"80544778-fabb-4dcd-aa35-17492e5dcf4f","Vulnerabilities","vulnerabilities",{"category":45},{"id":23,"icon":25,"name":26,"slug":27},[],[18],{"controls":49,"vendors":136},[50,79,108],{"slug":51,"name":52,"problem":53,"products":54},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",[55,63,71],{"vendor_slug":56,"vendor_name":57,"vendor_logo":58,"product_slug":59,"product_name":60,"url":61,"description":62},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","entra-id","Microsoft Entra ID","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fidentity-access\u002Fmicrosoft-entra-id","Cloud identity and access management with single sign-on, conditional access, passkeys and identity governance.",{"vendor_slug":64,"vendor_name":65,"vendor_logo":66,"product_slug":67,"product_name":68,"url":69,"description":70},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","workforce-identity","Okta Workforce Identity","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fworkforce-identity\u002F","Single sign-on, adaptive MFA including phishing-resistant methods, and lifecycle management for employees.",{"vendor_slug":72,"vendor_name":73,"vendor_logo":74,"product_slug":75,"product_name":76,"url":77,"description":78},"yubico","Yubico","\u002Fvendor-logos\u002Fyubico.png","yubikey","YubiKey","https:\u002F\u002Fwww.yubico.com\u002Fproducts\u002F","Hardware security keys for FIDO2, passkeys and smart card login, in USB and NFC versions.",{"slug":80,"name":81,"problem":82,"products":83},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[84,92,100],{"vendor_slug":85,"vendor_name":86,"vendor_logo":87,"product_slug":88,"product_name":89,"url":90,"description":91},"withsecure","WithSecure","\u002Fvendor-logos\u002Fwithsecure.png","elements-xdr","WithSecure Elements XDR","https:\u002F\u002Fwww.withsecure.com\u002Fen\u002Ffor-business\u002Fplatform\u002Fxdr\u002F","Endpoint detection and response with extended detection, on the Elements cloud platform.",{"vendor_slug":93,"vendor_name":94,"vendor_logo":95,"product_slug":96,"product_name":97,"url":98,"description":99},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-insight-xdr","Falcon Insight XDR","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fendpoint-security\u002Ffalcon-insight-xdr\u002F","Endpoint detection and response with extended detection across other security tools.",{"vendor_slug":101,"vendor_name":102,"vendor_logo":103,"product_slug":104,"product_name":105,"url":106,"description":107},"sentinelone","SentinelOne","\u002Fvendor-logos\u002Fsentinelone.png","singularity-endpoint","Singularity Endpoint","https:\u002F\u002Fwww.sentinelone.com\u002Fplatform\u002Fendpoint-security\u002F","Endpoint protection and detection with automated response and rollback.",{"slug":27,"name":109,"problem":110,"products":111},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[112,120,128],{"vendor_slug":113,"vendor_name":114,"vendor_logo":115,"product_slug":116,"product_name":117,"url":118,"description":119},"reliaquest","ReliaQuest","\u002Fvendor-logos\u002Freliaquest.png","greymatter-digital-risk-protection","GreyMatter Digital Risk Protection","https:\u002F\u002Freliaquest.com\u002Fsecurity-operations-platform\u002Fdark-web-and-digital-risk-protection\u002F","Watches the open, deep and dark web for threats aimed at an organisation and alerts its security team in real time.",{"vendor_slug":121,"vendor_name":122,"vendor_logo":123,"product_slug":124,"product_name":125,"url":126,"description":127},"dataminr","Dataminr","\u002Fvendor-logos\u002Fdataminr.png","agentic-threat-intelligence-platform","Agentic Threat Intelligence Platform","https:\u002F\u002Fwww.dataminr.com\u002Fproducts\u002Fcyber-defense\u002Fagentic-threat-intelligence-platform\u002F","Threat intelligence platform, formerly ThreatConnect TI Ops, that collects, scores and structures intelligence and pushes it into security tools.",{"vendor_slug":129,"vendor_name":130,"vendor_logo":131,"product_slug":132,"product_name":133,"url":134,"description":135},"defused","Defused","\u002Fvendor-logos\u002Fdefused.png","defused-tf","Defused TF","https:\u002F\u002Fdefusedcyber.com\u002Fproduct\u002Ftf","Threat intelligence feed from honeypots Defused runs on several continents, showing which vulnerabilities attackers are exploiting right now, with payloads and indicators.",[137],{"slug":138,"name":139,"logo_path":140,"roles":141},"apple","Apple","\u002Fvendor-logos\u002Fapple.png",[142],"reported_by",{"slug":144,"title":145,"body":146,"framework_refs":147,"framework_notes":155},"apple-alerts-99-countries-to-mercenary-spyware-targeting-high-risk-users","Apple Alerts 99 Countries to Mercenary Spyware Targeting High-Risk Users","Sophisticated mercenary spyware campaigns, likely leveraging zero-click or highly targeted exploits, were deployed against journalists and activists across 99 countries, demonstrating that nation-state-level threat actors operate globally with near-impunity. Apple's decision to notify potential victims reflects the critical role vendors play in the absence of individual user detection capabilities. The targeting of journalists based on their reporting underscores that spyware is increasingly weaponized to suppress dissent and free press. Because these attacks are highly tailored and technically advanced, standard consumer security hygiene alone is insufficient — targeted individuals require elevated operational security practices and rapid response guidance.",[148,149,150,151,152,153,154],"CIS Control 14: Security Awareness and Skills Training","CIS Control 17: Incident Response Management","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","NIST SP 800-53 SI-2: Flaw Remediation","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","MITRE ATT&CK T1566: Phishing","GDPR Article 32",{"GDPR Article 32":156,"MITRE ATT&CK T1566: Phishing":157,"NIST SP 800-53 SI-2: Flaw Remediation":158,"CIS Control 17: Incident Response Management":159,"CIS Control 14: Security Awareness and Skills Training":160,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":161,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":162},"Organizations processing personal data of journalists or activists have a legal obligation under GDPR to implement appropriate technical and organisational measures; a spyware compromise of employee devices likely constitutes a personal data breach requiring notification and remediation.","Mercenary spyware such as Pegasus is frequently delivered via spear-phishing links or zero-click message exploits; understanding and defending against this initial access technique is central to disrupting the kill chain used against targeted individuals.","Mercenary spyware campaigns routinely exploit known or recently disclosed vulnerabilities in mobile operating systems, making timely patch application a foundational control to close the exploitation window.","Apple's threat notifications serve as an external incident trigger; organizations must have a defined incident response procedure to act on such notifications quickly, including device isolation, forensic analysis, and user support for affected individuals.","Journalists and high-risk users targeted by mercenary spyware often lack the operational security training needed to recognize targeting attempts; role-specific awareness training would reduce susceptibility to the social engineering vectors that often precede spyware delivery.","A formal vulnerability management process would ensure that devices used by high-risk personnel are kept current with security patches, directly reducing the exploitable attack surface targeted by sophisticated spyware operators.","Mercenary spyware often seeks to harvest credentials and session tokens; enforcing strong authentication and minimizing credential exposure limits the lateral damage an attacker can achieve once a device is compromised."]