Thailand government officials met with representatives from Apple this week to discuss security notifications the company sent to politicians and others in the country warning of possible targeting by mercenary spyware, according to reporting by Bloomberg News‘ Mark Gurman.
The alerts, issued by Apple on October 29 after detecting activity consistent with such attacks, formed part of a broader global notification sent to individuals in 99 countries. Several Thai politicians publicly confirmed receiving the warnings, prompting questions about the source and intent of any attempted intrusions.
Digital Economy and Society Minister Chaichanok Chidchob has described the scale of the threat as unprecedented. The discussions with Apple are part of a series of engagements; following the meeting, the ministry plans to coordinate with Thailand’s National Security Council, the National Cyber Security Agency, and domestic hardware and software firms to assess the situation and develop a response. Officials have indicated a more comprehensive security plan could be ready the week of November 16.
The alerts have drawn particular attention because they reached opposition figures, including People’s Party leader Natthaphong Ruengpanyawut and Democrat Party leader Abhisit Vejjajiva, in the period leading up to a scheduled December no-confidence debate. The government has denied any state role in targeting politicians and has stated there is no confirmed evidence linking the activity to specific tools such as the Pegasus spyware previously associated with NSO Group. Receiving a notification does not necessarily mean a device was successfully compromised.
Apple has characterized mercenary spyware attacks as far more sophisticated than typical cybercrime, often requiring significant resources and aimed at a limited number of high-value targets. The company issues “high-confidence” threat notifications in such cases and has previously recommended steps including enabling Lockdown Mode on affected devices.
The episode echoes earlier episodes in Thailand in which Apple issued similar warnings to activists, journalists, and academics around 2021 amid political protests, with researchers at the time linking some activity to Pegasus. Thai authorities have previously acknowledged past interest by state agencies in acquiring such tools, though they maintain no current involvement in the latest alerts.
The ministry is also expected to broaden consultations to cover risks on other platforms, including Android devices, as part of efforts to strengthen overall national cybersecurity preparedness.
MacDailyNews Take: Apple’s threat notifications indicate that the company has detected a high-confidence attempt to use mercenary spyware against a specific individual. These commercial tools, often sold to state actors, can extract messages, location data, and other sensitive information. Many such attacks rely on zero-click exploits that require no action from the victim, such as opening a link or file. Apple does not confirm whether an attack succeeded and does not attribute the activity to any particular government or operator.
Apple’s Lockdown Mode is available in iOS 16 or later, iPadOS 16 or later, watchOS 10 or later, and macOS Ventura or later. Additional protections are available starting in iOS 17, iPadOS 17, watchOS 10, and macOS Sonoma. More info about Lockdown Mode here.
Please help support MacDailyNews — and enjoy subscriber-only articles, comments, chat, and more — by subscribing to our Substack: macdailynews.substack.com. Thank you!
Support MacDailyNews at no extra cost to you by using this link to shop at Amazon.
Like 🙂 or dislike 🙁 this post below!