The reason Apple issued an emergency warning to iPhone users in 92 countries

On April 11, 2024, Apple issued a warning to users in 92 countries, including India, about a 'mercenary spyware attack' that it believes may have affected to iPhone customers. Apple did not provide any further details other than to say that the attack was an attempt to 'remotely compromise the iPhone'.

LightSpy is said to be the reason Apple urgently warned iPhone users.

Now, according to a research report on Blackberry Blog, the attack may have been carried out using 'a sophisticated iOS infection' called LightSpy. The technology is believed to have been absent since it was used in a 2020 hacking campaign amid escalating political tensions in Hong Kong.

The return of LightSpy comes in a new form through a version called LightSpy F_Warehouse, which includes the ability to target documents and personal media on iPhones, able to steal files from apps like WeChat and Telegram.

Blackberry says LightSpy can also secretly record audio from infected iPhones, including VOIP calls. At the same time, it can identify what the security blog describes as 'location data in a super clear way'. The blog says: 'Evidence such as code comments and error messages clearly show that the attackers behind LightSpy are native Chinese speakers.'

iPhone users are recommended to use Lockdown Mode for safety.

The blog content includes a description of how LightSpy works when present on an iPhone and how it avoids detection. Regarding how the iPhone was first infected, security experts believe that LightSpy uses a method of targeting websites. BlackBerry advises users who are potential targets working in sensitive fields such as journalists or the government to use the Lockdown Mode that Apple provides on the iPhone.