In December, hundreds of iPhone and Android users received a threat notification, warning them their device had been targeted by spyware. Days later, Apple and Google patched security holes that experts think were used to plant the stealthy malware on a select group of devices.
Spyware is so dangerous because the adversary is able to see and hear everything you do on your smartphone, including via encrypted messaging apps such as WhatsApp and Signal. But it tends to be extremely targeted against dissidents, journalists, politicians, and business leaders operating in certain sectors.
The malware has hit a number of high-profile people, including former Amazon CEO Jeff Bezos and Hanan Elatr, wife of murdered Saudi dissident Jamal Khashoggi—who were both compromised by NSO Group’s Pegasus spyware.
Today, spyware remains just as prolific in these circles, but experts think its impact could be widening. In early December, as Google issued its threat notification, the tech firm’s researchers detailed how an exploit chain was used to install Predator spyware surreptitiously onto a device.
It came after an alert issued by the US Cybersecurity and Infrastructure Security Agency (CISA), warning users that adversaries are “actively leveraging” commercial spyware to target mobile messaging applications.
As the risk increases, what can you do to protect your Android device or Apple iPhone?
Zero-Click Attacks
Spyware often hits smartphones in so-called zero-click attacks, meaning your phone can become infected without clicking a link, downloading a malicious image, or any other kind of user interaction.
The attack cannot be mitigated via the usual routes. If the malware has infected your smartphone, adversaries can “read messages, observe keystrokes, take screenshots, monitor notifications, and access banking apps,” according to Pieter Arntz, a senior malware researcher at security firm Malwarebytes.
With full system access, spyware can “exfiltrate data such as emails and texts, send messages, steal credentials, and log in to cloud systems,” says Rocky Cole, cofounder of iVerify, an app that helps users to detect spyware.
Aside from zero-click attacks, spyware can infect a device when someone clicks on a compromised link sent over text, email, or social media. Meanwhile, the malware can hide in malicious apps that appear to be legit. It can also be concealed in an image file and downloaded via a message, or get onto your smartphone due to vulnerabilities in your browser.
Infection usually starts through malicious links and fake apps, but it is also taking place via “more subtle methods,” says Richard LaTulip, a field CISO at security company Recorded Future, which collaborated with Google’s threat intelligence team on the Predator spyware findings.
LaTulip cites the example of recent research on malicious browser extensions affecting millions of users that shows “how seemingly harmless tools can become surveillance devices.”
These techniques, often developed by nation-state adversaries linked to governments, indicate a trend toward “more covert, persistent, and device-level compromises,” he says.
A Bigger Problem
Over the past few years, spyware has become a growing issue. Governments and the companies that make the malware say the surveillance tools are used to target only criminals and terrorists, or for national security purposes.
“But the truth is that human rights activists, journalists, and many others across the world have been unlawfully targeted with spyware,” Rebecca White, Amnesty International’s researcher on targeted surveillance, tells WIRED. “In this way, spyware can be used as a tool of repression—to silence people speaking truth to power.”
Thai activist Niraphorn Onnkhaow is a prime example. Between 2020 and 2021, at the height of Thailand’s pro-democracy protests, Onnkhaow was targeted 14 times by Pegasus spyware. Soon afterward, she decided to end her role in the protest movement amid fears that her private data could be weaponized against her.
“Data can be weaponized and lead to more abuse, online and offline—especially for people who already face discrimination based on their identity; for example, on the basis of gender or race,” White says.
Beyond activists, mobile spyware appears to be targeting a wider subset of people, often within a business environment. The malware is hitting “a wide range of society,” from government officials to financial IT workers, says iVerify’s Cole. “Increasingly, it’s used beyond intelligence gathering, to steal credentials for enterprise access.”
Signs You’ve Been Hit
Spyware is difficult to detect—especially sophisticated strains such as Pegasus and Predator, which are typically only discovered via forensic analysis. But you might notice some subtle signs, such as your device overheating or slowing down, or your camera or mic activating when they’re not supposed to be in use.
While advanced spyware may leave little to no visible trace, sudden drops in performance or changes in connectivity can serve as early warning signs, says LaTulip.
One more obvious indicator of being hit by a sophisticated campaign is an official threat notification from Apple, Meta, or Google. This “should be taken seriously,” White says.
Another sign is leaked private information that you haven’t shared previously, or if colleagues or friends have been compromised.
How to Prevent and Mitigate Spyware
The most reliable way to mitigate spyware is to prevent your device being taken over in the first place. If you think you may be at risk, Apple offers Lockdown Mode, which includes a higher level of security with reduced functionality that has improved over time as the feature has been updated. For example, it blocks most message attachments and incoming FaceTime calls.
To enable Lockdown Mode on your iPhone, go to Settings > Privacy & Security > Lockdown Mode and tap Turn On Lockdown Mode.
Ivan Krstić, vice president of Apple security engineering and architecture, tells WIRED there “has never been a successful, widespread malware attack” against the iPhone. The only system-level iOS attacks Apple has seen in the wild come from mercenary spyware, according to the iPhone maker. In other words, iPhones have been infected with spyware, but only the most sophisticated type, Krstić says.
Krstić describes how mercenary spyware is “historically associated with state actors and costs millions of dollars to target a very small number of specific individuals and their devices.” He adds that Apple has continued to develop new methods for combating spyware, including Lockdown Mode and Memory Integrity Enforcement.” Introduced alongside the latest iPhone line-up, Memory Integrity Enforcement is a “comprehensive, always-on memory-safety protection,” which helps prevent memory corruption exploits often used in spyware attack chains.
Krstić is confident about Memory Integrity Enforcement’s advancements, claiming that the new feature is “the most significant upgrade to memory safety in the history of consumer operating systems.”
Google offers spyware protection for Android called Advanced Protection, which has been enhanced in Android 16 with intrusion logging, USB protection and the option to disable auto-reconnect to insecure networks. It can be enabled via your Settings > Security & Privacy > Other Settings > Advanced Protection.
In addition to using anti-spyware features, all users should be mindful of clicking links from strangers, says White. “Pay attention to changes in devices’ functioning. Using a reputable VPN can help prevent some forms of surveillance and censorship,” she says. “Evaluate any new requests for social media followers before accepting. Visit Amnesty’s secure onion website, privately and anonymously, using the Tor network’s browser.”
More generally, exercise “strict control” over what gets installed on your device, adds Arntz.
At the same time, avoid side-loading on Android and ensure your mobile operating system and apps are fully updated. “Patches often close the same vulnerabilities that spyware relies on,” warns LaTulip.
Experts say spyware can be temporarily disrupted by turning your smartphone off and on again. However, if the malware does get on your device, the best course of action is to ditch it altogether.
Alongside Amnesty, several organizations can support members of civil society concerned they have been targeted with spyware, such as Access Now and Reporters Without Borders.
Above all, operate with a healthy skepticism, says LaTulip. “Assume compromise is possible, but avoid the paranoia that shuts down normal use.”
The post How to Protect Your iPhone or Android Device From Spyware appeared first on Wired.
