France’s Information Security Agency has confirmed that Apple issued a fresh round of spyware threat notifications to users earlier this month. The alerts, sent on September 3, 2025, mark the fourth wave this year following previous notifications in March, April, and June.
What the Notifications Mean
The agency explained that Apple has been warning individuals targeted by spyware since 2021. The software involved includes Pegasus, Predator, Graphite, and Triangulation. These tools are highly sophisticated, hard to detect, and often used against people in sensitive roles such as journalists, lawyers, activists, politicians, and senior officials.
Don’t miss the best of The Mac Observer
Set us as a preferred source and our Apple reporting ranks higher in your Google Search results and Discover feed — one tap, no account changes.
According to the report, receiving an Apple alert means that at least one device linked to an iCloud account was targeted and could be compromised. The notifications arrive via iMessage from verified Apple addresses and appear as alerts when logging into iCloud. Apple also follows up with an email from official domains, such as threat-[email protected].
The report stressed that recipients should not alter their devices immediately. Resetting, deleting apps, or updating can interfere with investigations. Instead, users are advised to quickly contact CERT-FR for technical support and preserve the original notification email.
The agency also highlighted broader security practices. It includes practices like update devices regularly, enable automatic updates, use strong passwords, turn on two-factor authentication, and restart devices daily. For those handling sensitive work, enabling Isolation Mode and separating personal from professional devices are strongly recommended.
CERT-FR explained that the notifications target highly sophisticated attacks that often exploit zero-day vulnerabilities or require no user interaction. It urged users to avoid installing unknown apps, clicking on suspicious links, or using unverified app stores.
Apple’s alert history shared by CERT-FR shows four campaigns documented in 2025 March 5, April 29, June 25, and September 3. The agency noted that the list is not exhaustive and only reflects campaigns it has confirmed.
For now, neither Apple nor French authorities have disclosed who was behind the September campaign or which individuals were targeted. The lack of attribution tells the difficulty of tracing advanced spyware operations.
Discussion