Apple Ups Bounty to $5 Million for Zero-Click Spyware Exploits Bypassing Lockdown Mode

Apple has announced a substantial overhaul of its Security Bounty programme, set to take effect this November, with rewards for zero-click, mercenary-grade spyware capable of remote intrusion without user interaction rising to as much as $5 million per case.

Under the new framework, such exploits tied to bypassing Lockdown Mode protections may earn the top prize, while other vulnerabilities can qualify for up to $2 million per case; one-click exploit chains can now yield up to $1 million, and nearby-attack scenarios have also been raised to $1 million. Physical attacks involving direct device access and lock bypassing are now worth $500,000, with web content code execution plus sandbox escape earning up to $300,000.

According to Ivan Krstić, Apple’s Vice President of Security Engineering and Architecture, the company has paid over $35 million in rewards to more than 800 researchers since the programme began. Apple notes that most system-level iOS attacks today originate from mercenary spyware operators targeting journalists, political figures and human rights advocates, prompting continued defence measures such as Lockdown Mode and Memory Integrity Enforcement.

Since the programme’s public launch in 2019, the reforms are intended to attract more elite researchers to strengthen iOS and macOS security in the face of increasingly sophisticated threats.