Representatives from Apple held official meetings with Thai government officials to discuss recent security warnings received by political figures and other users in the country regarding their exposure to attempted targeting by mercenary spyware.
These talks follow a wave of security alerts issued by Apple on October 29, which included users in 99 countries. The company explained that these alerts were sent after detecting technical activities consistent with patterns of targeted cyberattacks sponsored by mercenary entities, raising concerns regarding the surveillance of political figures and public activities in Thailand.
Official stance and history of espionage in Thailand
Thailand's Minister of Digital Economy and Society, Chaitchanok Chidchob, confirmed after meeting with Apple representatives that the threat notifications issued by the company do not definitively conclude that attackers successfully breached the targeted devices and accessed their data. Local authorities also stated that there is currently no direct evidence linking the recent hacking attempts to the well-known spyware Pegasus, developed by NSO Group.
Nevertheless, Thailand has a documented history with Pegasus spyware attacks; a 2022 investigation by Citizen Lab, in collaboration with local organizations, revealed that at least 30 people in Thailand were infected between October 2020 and November 2021. Those targeted at the time included activists, politicians, academics, and lawyers. Apple's previous notifications in November 2021 were the spark that prompted victims to contact security researchers and initiate the investigation.
Apple's mechanism for countering mercenary spyware
Apple has relied on a threat notification system since 2021, with its warnings reaching users in more than 150 countries to date. The company explains that mercenary spyware operations consume massive financial and technical resources to target specific individuals precisely due to the nature of their work or their public and sensitive roles.
Apple's guidelines indicate that warnings are based on a high degree of confidence that the user is being directly targeted, while emphasizing that digital detection tools do not provide absolute certainty. To protect its security standards, the company chooses not to disclose the exact technical details of how it detects attacks to prevent spyware developers from adjusting their methods and avoiding detection, and it also prefers not to attribute responsibility to specific entities or geographic regions.
What does this development mean for users?
This development reflects the persistence of high-level cyber threats targeting the smartphones of public figures and politicians, and underscores the importance of responding quickly to official security notifications. Apple recommends that users who receive security notifications enable Lockdown Mode on their iPhones to reduce the attack surface, while seeking assistance from cybersecurity professionals. To verify the authenticity of the alert and avoid falling into the trap of phishing messages, the company urged those targeted to log in directly to their accounts via the official website (account.apple.com) to verify the existence of the official notification.