Threat notification campaign by Apple should be taken seriously, CERT-FR says

France’s Computer Emergency Response Team (CERT-FR) has issued a press release stating that Apple’s threat notification campaign regarding spyware should not be taken lightly.

Since 2021, Apple has launched several notification campaigns to individuals targeted by spyware, such as Pegasus, Predator, Graphite, and Triangulation. Journalists, lawyers, activists, politicians, senior civil servants, and members of management committees of strategic sectors have proven to be popular targets for threat actors.

If users receive a notification via iMessage or email from Apple, this means that at least one device linked to their iCloud account has been compromised. The alert is displayed when they log in to their iCloud account.

“It is important to promptly take these notifications into account and implement the appropriate measures,” CERT-FR says in a public statement.

Anyone who receives a warning from Apple is advised to contact CERT-FR immediately for technical support. The agency also recommends saving the notification email from Apple and avoiding making changes to the device, such as performing a reset, deleting apps, installing updates, or restarting the device. Such changes may hinder the investigation into the spyware.

To mitigate the risk of spyware, users should update their iPhone as quickly as possible to the most recent version of Apple’s operating system. This way, users can fix (zero-day) vulnerabilities that are being exploited by spyware. The same goes for security updates.

In addition, CERT-FR advises using separate devices for personal and professional use and restarting your iPhone regularly.

More generally, users shouldn’t click on suspicious links or attachments, implement a strong and unique access code, enable two-factor authentication (2FA) whenever possible, and avoid installing unknown apps or applications from alternative app stores.