Apple’s Lockdown Mode is back in focus after fresh reporting and expert comments highlighted how well the feature holds up against zero day spyware attacks targeting iPhones and Macs, especially for people who face a higher risk of government-backed surveillance.
TechCrunch reports that Apple says it still has not seen a successful mercenary spyware attack against a device that had Lockdown Mode enabled at the time of the attack. That matters because Apple built the feature for exactly these situations, where attackers use advanced tools to break into devices without warning and, in some cases, without any user interaction.
Don’t miss the best of The Mac Observer
Set us as a preferred source and our Apple reporting ranks higher in your Google Search results and Discover feed — one tap, no account changes.
Apple introduced Lockdown Mode in 2022 as an optional security setting that shuts down or limits features that attackers often abuse. Since then, the company has also sent spyware threat notifications to users in more than 150 countries, which shows how seriously it now treats mercenary spyware campaigns and targeted attacks.
Lockdown Mode
Lockdown Mode appears to make spyware attacks far harder, more expensive, and less reliable.
Amnesty International’s security lab head Donncha Ó Cearbhaill said his team has not found evidence of an iPhone being successfully compromised by mercenary spyware while Lockdown Mode was turned on. That lines up with previous findings from groups that track spyware abuses and investigate real-world attacks on Apple users.
Patrick Wardle, an Apple cybersecurity expert and longtime critic, also gave Lockdown Mode strong praise for how aggressively it reduces risk.
“It kills entire delivery mechanisms/exploit classes, as it blocks most message attachment types, restricts WebKit features. This is really a huge reduction in remotely reachable attack surface, especially for zero-click exploit chains.”
Patrick Wardle told TechCrunch.
A strong defense with small trade-offs
Wardle’s description of “shrinking the attack surface” explains why this feature stands out. Lockdown Mode cuts off many of the paths spyware vendors normally use, and that forces them to spend more money and effort on “more complex and expensive techniques” that are harder to build and deploy.
For most people, Lockdown Mode is still unnecessary. But for journalists, activists, political figures, lawyers, and anyone worried about targeted digital attacks, Apple’s most aggressive consumer-facing hardening feature looks more valuable than ever.
Discussion