French Advisory Sheds Light on Apple Spyware Activity

According to CERT-FR, France’s national cybersecurity agency, a recent advisory shed more light on spyware attacks against Apple users, noting four Apple security notifications this year, the latest issued on 3 September. The advisory comes after Apple disclosed CVE-2025-43300, a zero-day in the ImageIO framework, on 20 August, which the company described as being exploited in an extremely sophisticated attack against targeted individuals.

CERT-FR said spyware programs such as Pegasus, Predator, Graphite, and Triangulation are particularly sophisticated and difficult to detect, with notifications indicating that at least one device linked to an iCloud account has been targeted and potentially compromised. The four notifications include ones issued on 3 September, 25 June, 29 April, and 5 March, with the March notification occurring shortly before Apple disclosed CVE-2025-24201, a zero-day in WebKit exploited in similarly sophisticated attacks.

To mitigate spyware threats, CERT-FR recommends timely updates, enabling automatic updates, and enabling Lockdown Mode on Apple devices, alongside restarting devices daily.