Apple Says Lockdown Mode Has Blocked Mercenary Spyware Attacks
Apple said it has not observed any successful mercenary spyware compromises on devices with Lockdown Mode enabled, nearly four years after launching the opt-in protection for users at elevated risk of targeted surveillance. Introduced in 2022, the feature hardens iPhones and other Apple devices by disabling or restricting functions that have repeatedly been abused in spyware campaigns, particularly the remotely reachable components used in zero-click exploit chains.
Independent findings cited by Apple support the claim. Researchers at Amnesty International and Citizen Lab said they have not seen evidence of successful infections on Lockdown Mode-enabled iPhones, and Citizen Lab documented cases in which the feature blocked Pegasus and Predator spyware attacks. Google researchers also reported at least one spyware campaign that abandoned infection attempts after detecting Lockdown Mode, while security researcher Patrick Wardle said the feature’s aggressive reduction of attack surface makes it especially effective against exploit delivery methods used by mercenary spyware operators.
Get ahead of threats like this
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
How this story unfolded
4 events from the most recent confirmed update back to the earliest known activity.
Apple says no Lockdown Mode users have been hacked with spyware
Apple said it has not observed any successful mercenary spyware attacks against devices with Lockdown Mode enabled, nearly four years after the feature's introduction. The statement was echoed in subsequent reporting describing Lockdown Mode as highly effective against zero-click exploit chains.
Google researchers observe spyware aborting on Lockdown Mode detection
Google researchers documented at least one spyware campaign in which the malware stopped its infection attempt after detecting that Lockdown Mode was enabled on the target device.
Citizen Lab documents Lockdown Mode blocking Pegasus and Predator attacks
Independent researchers at Citizen Lab reported cases in which Lockdown Mode prevented infection attempts involving Pegasus and Predator spyware targeting iPhones. Amnesty International and Citizen Lab also said they had not seen evidence of successful compromises of Lockdown Mode-enabled iPhones.
Apple introduces Lockdown Mode for high-risk users
Apple launched Lockdown Mode in 2022 as an opt-in hardening feature for iPhones and other Apple devices, restricting or disabling functionality commonly abused in mercenary spyware attacks.
Related entities
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Sources
2 references tracked. Mallory keeps watching after this page renders.
See the full picture, correlated to your attack surface.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Related stories
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Debate Over Mobile OS Lockdown Measures to Reduce Malware and Targeted Attacks
Discussion focused on whether stronger *platform-level restrictions* are necessary to curb mobile threats, contrasting Android’s openness with iOS’s “lockdown” approach. One thread highlights Google’s plan to require centralized **developer registration/verification** for apps installed on Android-certified devices (even if distributed outside Google Play), framed as a way to reduce malware and prevent repeat offenders from re-signing and redistributing blocked apps; it also notes Android’s recent mitigations such as **Restricted Settings** (Android 14) and **Enhanced Confirmation Mode** (Android 15) as partial technical barriers against common scam/phishing tactics. Separately, iOS **Lockdown Mode** is presented as an extreme, reversible hardening option intended for high-risk users (e.g., journalists, activists) that reduces attack surface by disabling or restricting features (e.g., most message attachments/link previews, certain web technologies, incoming FaceTime from unknowns, accessory connections while locked, non-secure Wi‑Fi, and installation of device management profiles). The article cites reporting that a seized journalist phone could not be accessed using law-enforcement forensic tooling when Lockdown Mode was enabled, underscoring how aggressive feature reduction can materially impede both targeted exploitation and post-seizure forensic access.
Jun 29, 2026
Apple iPhone Lockdown Mode Prevents FBI Forensic Extraction of Seized Journalist Device
Court filings in a US leak investigation indicate the FBI was unable to forensically extract data from Washington Post reporter Hannah Natanson’s iPhone because **Apple’s Lockdown Mode** was enabled. The government document states the FBI’s Computer Analysis Response Team (**CART**) “could not extract that device,” offering a rare, real-world data point on Lockdown Mode’s effectiveness against at least some standard law-enforcement mobile forensics workflows. The filings also describe limited recovery from the device’s SIM card via a CART tool that produced an auto-generated HTML report containing only the phone number, and note the FBI paused further extraction attempts due to a court “Standstill Order.” The search and seizure occurred amid an investigation into government contractor **Aurelio Perez-Lugones**, whom prosecutors believe was a source for classified information; investigators also reviewed **Signal** messages between Perez-Lugones and the reporter as part of the case. Apple positions Lockdown Mode (introduced in 2022 for iPhone/iPad/Mac) as a high-risk protection that reduces attack surface by restricting attachments, inbound FaceTime from unknown contacts, certain web technologies, and other features.
Jun 29, 2026
WhatsApp Introduces Strict Account Settings for Lockdown-Style Spyware Defense
WhatsApp announced a new optional security mode, **“Strict Account Settings,”** designed to reduce exposure to *highly sophisticated attacks*—particularly **mercenary spyware**—by limiting risky functionality when enabled. The feature is expected to roll out in the coming weeks and includes restrictions such as blocking attachments and media from people not in a user’s contact list; it can be enabled via `Settings > Privacy > Advanced`. WhatsApp positioned the change as an additional layer beyond default **end-to-end encryption**, aimed at higher-risk users such as journalists and public-facing figures, and noted its ongoing legal fight with **NSO Group** over the 2019 Pegasus campaign that targeted roughly 1,400 WhatsApp users. The approach mirrors Apple’s **Lockdown Mode**, which similarly reduces attack surface for a small subset of users who may be personally targeted by advanced threats by disabling or constraining features across core services. Apple documents that Lockdown Mode blocks most message attachment types, limits complex web technologies, restricts incoming FaceTime calls to recent contacts, blocks certain Apple service invitations, and removes some photo-sharing metadata—trading usability for stronger protection against targeted exploitation. Together, the updates reflect a broader industry pattern of offering *opt-in, high-friction hardening modes* to mitigate spyware and other highly targeted intrusion techniques.
Jun 29, 2026