ANSSI tracks Apple spyware threat notifications
CERT-FR catalogs Apple's ongoing mercenary spyware notification campaigns (Pegasus, Predator, Graphite, Triangulation) targeting high-profile individuals since 2021.
Sourcecert.ssi.gouv.fr — open the original
What to check
- Applies to
- Whether this concerns you is not assessed; the names the report mentions are listed below.
CERT-FR (ANSSI) has published an advisory consolidating Apple's threat notification campaigns, which alert iCloud users when their devices may have been targeted by state-sponsored or commercial spyware such as Pegasus, Predator, Graphite, or Triangulation. These tools are described as highly sophisticated, frequently leveraging zero-click or zero-day exploits, and are used to target journalists, lawyers, activists, politicians, senior officials, and executives in strategic sectors. Apple notifies affected users via iMessage and email from threat-notifications[at]email.apple.com or threat-notifications[at]apple.com, as well as an in-account alert, though the delay between compromise attempt and notification can span several months.
The advisory lists known notification waves tracked by CERT-FR from March 2025 through August 2026 (dates as published), noting the list is not exhaustive and only reflects campaigns known to the French CERT. It provides guidance for recipients of such notifications: contact CERT-FR promptly, preserve the notification email, and avoid resetting or modifying the device to preserve forensic evidence.
Mitigation recommendations include prompt patching and enabling automatic updates, using Apple's Lockdown Mode, separating personal and professional device use, regular reboots, strong unique passcodes, two-factor authentication, avoiding sideloaded apps and suspicious links, and for organizations, issuing dedicated managed devices and excluding personal electronics from sensitive meetings. The advisory serves primarily as an informational tracking resource rather than reporting a new incident.
Mentioned in this report
Source reporting: https://www.cert.ssi.gouv.fr/cti/CERTFR-2025-CTI-010
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the malware it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,433 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs