Apple alerts journalists, activists about state-sponsored hacking attempts after NSO Group suit

The notice validates, yet again, accusations that NSO Group's spyware is used to target journalists and political targets.

On the same day Apple announced a lawsuit against Israeli spyware vendor NSO Group for developing hacking tools to help breach iOS technology, the company was notifying potential targets of those exploits.

El Faro, a news organization in San Salvador, El Salvador, reported late Tuesday that 12 of its staff members received notices from the company, which warned that that “Apple believes you are being targeted by state-sponsored attackers who are trying to remotely compromise the iPhone associated with your Apple ID.” The company also sent notices to four others in San Salvador who are “leaders of Civil Society organizations and opposition political parties,” the news organization reported.

Notices were also sent to six Thai activists and researchers critical of the government there, Reuters reported.

NSO Group develops software designed to allow access to target devices through various bugs in Apple’s technology. A company spokesperson told CyberScoop Tuesday that its work is to “provide governments the lawful tools” to fight crime. Any abuses of its software will be investigated, the company claims, though repeated stories over several years paint a picture of the software being used by authoritarian governments to crack down on human rights activists, journalists, and political opposition.

El Faro did not attribute the alleged targeting using the NSO Group software. However the government of El Salvador, led by President Nayib Bukele, has been accused by critics of leading an effort to undermine judicial independence, political opposition and an independent press. An El Faro editor was expelled from the country in July, the New York Times reported.

In announcing its suit against NSO Group, Apple said that the FORCEDENTRY spyware, built by NSO Group, was “used to attack a small number of Apple users worldwide.” The company would be notifying the uses that it discovered the possible targeting using the exploit. “Any time Apple discovers activity consistent with a state-sponsored spyware attack, Apple will notify the affected users in accordance with industry best practices,” the company’s announcement read.

Apple representatives did not immediately respond to a request for comment. El Faro did not immediately respond to a request for comment.

Apple’s notice to the El Faro staffers said the “attackers are likely targeting you individually because of who you are or what you do.” If the device was compromised, the attacker would be able to remotely access sensitive data, communications, or even the camera and microphone, the notice read. “While it’s possible this is a false alarm, please take this warning seriously.”

NSO Group has a history of operating in the region. The government of Mexico was one of the company’s first major clients and served as “something of a laboratory for the spy technology,” the Guardian reported this summer as part of a broad expose of the technology’s abuse in that country. A Mexican businessman was arrested on and charged with using the technology to spy on a journalist, the paper reported on Nov. 9.

Pegasus, NoviSpy variant spyware found on devices of Serbian activists

It’s the first Pegasus infection of 2026 that Citizen Lab is forensically confirming, and the SHARE Foundation said it’s the biggest wave of spyware surveillance in Serbia…

Someone infected a spyware probe overseer with spyware

Meta accuses NSO Group of defying spyware injunction, files contempt of court complaint

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Wyden seeks upgraded NSA security guidance on commercial VPN use

• The Collective Cyber Defense letter wrote your next vendor questionnaire

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

Threats

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure

• Election official says Tina Peters would be consultant, won’t have access to election systems