Several opposition leaders and journalists received threat alerts from Apple that “State-sponsored attackers may be targeting your iPhone”. Mahua Moitra tweeted two screenshots of email and iMessage alerts with a caption, "Received text & email from Apple warning me Govt trying to hack into my phone & email.@HMOIndia - get a life. Adani & PMO bullies - your fear makes me pity you. @priyankac19 - you, I , & 3 other INDIAns have got it so far".

The alert reads, “Apple believes you are being targeted by state-sponsored attackers who are trying to remotely compromise the iPhone associated with your Apple ID. These attackers are likely targeting you individually because of who you are or what you do… If your device is compromised by a state-sponsored attacker, they may be able to remotely access your sensitive data, communications, or even the camera and microphone. While it is possible that this is a false alarm, please take this warning seriously”.

Indian Government Reaction

Minister of Electronics and Information Technology Ashwini Vaishnaw tweeted,

"We are concerned by the statements we have seen in media from some MPs as well as others about a notification received by them from Apple. The notification received by them as per media reports mentions about ‘state-sponsored attacks’ on their devices. However much of information by Apple on this issue seems vague and non-specific in nature. Apple states these notifications maybe based on information which is ‘incomplete or imperfect’. It also states that some Apple threat notifications maybe false alarms or some attacks are not detected. Apple has also claimed that Apple IDs are securely encrypted on devices, making it extremely difficult to access or identify them without the user's explicit permission. This encryption safeguards the user's Apple ID and ensures that it remains private and protected. The Government of Bharat takes its role of protecting the privacy and security of all citizens very seriously and will investigate to get to the bottom of these notifications. In light of such information and widespread speculation, we have also asked Apple to join the investigation with real, accurate information on the alleged state sponsored attacks".

Apple's Response

Apple has issued a clarification now on the issue and said in a statement, “Apple does not attribute the threat notifications to any specific state-sponsored attacker". The company further added, “State-sponsored attackers are very well-funded and sophisticated, and their attacks evolve over time. Detecting such attacks relies on threat intelligence signals that are often imperfect and incomplete.” Further, the company noted that, “It’s possible that some Apple threat notifications may be false alarms, or that some attacks are not detected. We are unable to provide information about what causes us to issue threat notifications, as that may help state-sponsored attackers adapt their behaviour to evade detection in the future.” India isn't the only country where users have received such notifications. Since enabling the Threat Notifications feature, they have reportedly been sent to individuals whose accounts are in nearly 150 countries.

About Apple threat notifications

Apple threat notifications are designed to inform and assist users who may have been targeted by state-sponsored attackers. After its launch in 2021, Apple had sent some of its first notifications to activists and researchers in Thailand, Reuters reported.

With Apple not providing much information apart from generic warnings to users, it is not clear if you’ve been targeted by a specific APT or threat group. As of now, users are left with vague knowledge that someone is out to get them. If it is state-sponsored it can be any state and even Apple can't determine which state.

As per Apple Support, unlike traditional cybercriminals, state-sponsored attackers apply exceptional resources to target a very small number of specific individuals and their devices, which makes these attacks much harder to detect and prevent. State-sponsored attacks are highly complex, cost millions of dollars to develop and often have a short shelf life. The vast majority of users will never be targeted by such attacks.

If Apple discovers activity consistent with a state-sponsored attack, we will notify the targeted users in two ways:

• A Threat Notification will be displayed at the top of the page after the user has signed in to appleid.apple.com.

• Apple will send an email and iMessage notification to the email addresses and phone numbers associated with the user’s Apple ID.

These notifications will provide additional steps that notified users can take to help protect their devices, including enabling Lockdown Mode.

Apple threat notifications never ask users to click any links, open files, install apps or profiles, or provide their Apple ID password or verification code by email or on the phone. To verify that an Apple threat notification is genuine, sign in to appleid.apple.com. If Apple has sent you a threat notification, it will be clearly visible at the top of the page after you have signed in.

All users should continue to protect themselves from cybercriminals and consumer malware by following best practices for security:

• Update devices to the latest software, as that includes the latest security fixes

• Protect devices with a passcode

• Use two-factor authentication and a strong password for Apple ID

• Install apps from the App Store

• Use strong and unique passwords online

• Don’t click on links or attachments from unknown senders

If you have not received an Apple threat notification, but have good reason to believe you may be targeted, you can enable Lockdown Mode on your Apple devices to help protect against highly sophisticated attacks.

Conclusion

Apple does not attribute the threat notifications to any specific state-sponsored attacker. So, it's impossible to determine whether the Indian Government is trying to spy on opposition leaders or not.