Apple spyware alert: France's CERT-FR says don't touch your device

The message reaches only a handful of people, but it lands in 99 countries at once. In late October, Apple sent a new series of warnings to iPhone, iPad and Mac users it believes were targeted by so-called "mercenary" spyware, surveillance tools sold to governments. CERT-FR, the incident response team of ANSSI (France's national cybersecurity agency), dates this campaign to October 29. On October 30, it updated its page on these notifications. The US press, including CyberScoop, reported on it on October 30.

According to Apple's alert message, quoted by CyberScoop, recipients are located in 99 countries. The company says it has already alerted users in more than 150 countries over the years. As usual, it names neither the spyware, nor the infection method, nor the perpetrator of the attacks.

An eighth wave logged by CERT-FR

CERT-FR keeps a list of known campaigns, noting that it is not exhaustive. The October 29 wave is the eighth since March 2025, and the second in a little over two months, after the one on August 13, 2026. Among those targeted are journalists and documentary filmmakers, according to CyberScoop.

These alerts are not theoretical. Between March 2025 and August 2026, a former French minister's iPhone was targeted three times by spyware.

You received the alert: what to do, and what not to do

CERT-FR's first recommended reflex is counterintuitive: don't touch the device. A factory reset, deleting apps, an update or even a restart can hinder the investigation. The agency advises you to:

• keep the notification email;
• contact CERT-FR quickly to get technical assistance;
• know that a genuine alert also appears when you sign in to your iCloud account, and pay attention to emails coming from Apple's notification addresses (threat-notifications@email.apple.com and threat-notifications@apple.com).

For people at risk (journalists, lawyers, activists, politicians, senior civil servants, executives in strategic sectors), CERT-FR recommends enabling Apple's Lockdown Mode (Lockdown Mode). It also advises installing updates as soon as they are released, restarting the device regularly and separating personal and work use, ideally on two devices. In companies, it recommends managed work phones and keeping devices out of rooms where sensitive topics are discussed.

Not receiving an alert proves nothing

John Scott-Railton, a researcher at the University of Toronto's Citizen Lab, calls the series of notifications "significant." But he points out that the absence of an alert does not guarantee the absence of infection. He also warns against companies selling paid "solutions" against spyware infections. For Natalia Krapiva of the NGO Access Now, the fight against spyware abuses is "far from over."

The timing is no coincidence. These alerts come shortly before the final negotiations of the Pall Mall Process, a voluntary international initiative meant to set rules of conduct for companies that sell hacking tools. What remains unknown is which spyware is behind this wave: according to CyberScoop, such alerts often lead victims to organizations like Access Now or Citizen Lab, which can result in more in-depth investigations.