Apple: No Spyware Attacks on Lockdown Mode Devices
Get the Tech newsletter
Daily tech — startups, AI labs, chips, the launches that shape the next decade. Free.
- Apple confirmed it is "not aware of any successful mercenary spyware attacks against a Lockdown Mode-enabled Apple device," spokesperson Sarah O'Rourke told TechCrunch, nearly four years after the feature's 2022 launch
- Lockdown Mode is an opt-in set of security protections designed to shield at-risk users from government-grade spyware made by NSO Group, Intellexa, and Paragon Solutions by disabling commonly exploited iPhone features
- Donncha Ó Cearbhaill, head of Amnesty International's security lab, said he and colleagues "have not seen evidence of an iPhone being successfully compromised by mercenary spyware where Lockdown Mode was enabled at the time of the attack"
- Citizen Lab researchers at the University of Toronto publicly documented at least two cases where Lockdown Mode actively blocked spyware—one using NSO's Pegasus, the other using Predator spyware from Intellexa
- Google security researchers reported a spyware variant that aborts an infection attempt when it detects Lockdown Mode, likely as an evasion tactic to avoid being observed
- Apple has sent spyware-targeting notifications to users in over 150 countries, though it has never disclosed the total number of people alerted
- Patrick Wardle, a prominent Apple cybersecurity researcher, called Lockdown Mode "one of the most aggressive consumer-facing hardening features ever shipped," noting it eliminates entire exploit classes by blocking most message attachment types and restricting WebKit features
Why it matters: For the highest-risk Apple users—journalists, dissidents, executives—Lockdown Mode now has multi-year, multi-researcher evidence that it works against the exact mercenary spyware sold to governments, at no cost beyond usability tradeoffs. The independent corroboration from Amnesty, Citizen Lab, and Google means security trainers can recommend it with more confidence, though researchers acknowledge a stealth bypass cannot be fully ruled out.
