Apple issues two fresh Pegasus-like spyware alerts in India

Apple alerts in India warn of Pegasus-like spyware attacks targeting individuals, sparking concerns over privacy and government surveillance.

At least two people in India on July 10 reported receiving a Pegasus-like alert from Apple, Inc. on their iPhones. The alerts, sent out on Tuesday night, warn them that they have been targeted by a targeted “mercenary” attack. Apple previously called these attacks “state-backed,” but changed this in April. Such spyware allows attackers to sift through targets’ personal devices, allowing them to view messages, photos, and tap into microphone and camera feeds in real time. 

Iltija Mufti, political adviser and daughter of former Jammu and Kashmir chief minister Mehbooba Mufti, reported receiving the alert, and so did Pushparaj Deshpande, founder of the Samruddha Bharat Foundation, which says on its website it works to “forge progressive coalitions”. Ms. Mufti and Mr. Deshpande told The Hindu that their phones were updated, and that they would soon get their devices forensically examined. 

An Apple spokesperson in India did not have an immediate comment to offer on the alerts. While the alert did not say that the attack was state-based, it named the Pegasus spyware as an example. Pegasus, a suite of snooping tools developed by the Israeli NSO Group Technologies, is only sold to governments. The Union government never confirmed or denied purchasing and using the Pegasus hardware, and refused to participate in a Supreme Court-ordered investigation into the spyware’s use. 

This is the first time in months that such spyware alerts have been issued. The last documented instance during which individuals received alerts was last October, when Apple devices belonging to The Wire news portal’s founding editor Siddharth Varadarajan and Anand Mangnale, South Asia Editor at the Organised Crime and Corruption Report Project, received such alerts. Subsequent forensic testing showed they were targeted with a vulnerability used by Pegasus clients. 

Editorial | Malware malice: On the Apple cyberattack alert

Both Ms. Mufti and Mr. Deshpande blamed the Union government and insisted that the spyware they had been warned about was Pegasus. “BJP shamelessly snoops on women only because we refuse to toe their line,” Ms. Mufti said in a post on X, formerly Twitter. Mr. Deshpande said: “Countless problems facing India which GoI should be redressing. Instead it’s more focused in deploying #Pegasus to scare & suppress.”

An international investigation in 2021 by the Forbidden Stories collective revealed the extent to which civil society organisations, opposition politicians and journalists were targeted around the world by Pegasus spyware. The Union government denied acting illegally but refused to confirm or deny expressly Pegasus deployment.