CERT-In responds to Apple spyware alerts affecting India

CERT-In issued an advisory on 14 August after Apple sent threat notifications to users worldwide, including India, concerning attempts by mercenary spyware operators to compromise their devices. The Indian agency’s notice recommended current device and application software and Lockdown Mode as additional safeguards.

It also supplied a separate instruction for recipients seeking device examination or technical assistance: changes such as resetting, deleting applications, updating or restarting a phone could disturb evidence. A recipient considering examination therefore needs case-specific guidance before changing the device. The notice directs those users to CERT-In’s mobile submission contact.

Apple’s explanation of threat notifications calls them high-confidence warnings that a user was individually targeted, while acknowledging that its investigations cannot reach absolute certainty. Apple does not identify a particular attacker or geographical region through these notifications.

An alert should be verified through the recipient’s Apple Account page. Apple says its notifications do not ask people to install apps or profiles, open files, or supply account passwords or verification codes by email or phone.

The sources do not establish a victim count for this August notification round. They also do not support naming a government or spyware vendor responsible for the attempts affecting Indian users. The advisory date records CERT-In’s response, rather than a verified start date for the underlying attacks. Apple’s guidance describes a targeted threat, rather than a notification issued indiscriminately to every device owner.