Technology and Science27 March, 20262 min read
Apple Reports No Known Successful Mercenary Spyware Attacks On Lockdown Mode Devices
This article is an automated aggregation of coverage from news outlets. Our editorials offer in-depth analysis curated by the NewsCord team.
Apple says no successful mercenary spyware attacks on Lockdown Mode devices. Lockdown Mode is opt-in and launched in 2022, hardening device security.
New development: Lockdown Mode holds
Apple’s latest public update on Lockdown Mode marks the most consequential new development in the spyware narrative: the company says there have been no known successful mercenary spyware attacks against devices with Lockdown Mode enabled. This claim reframes the threat, suggesting Lockdown Mode functions as more than a defensive option in the zero-click era. Amnesty International and Citizen Lab researchers have documented spyware attacks on iPhones, but public cases do not show a bypass of Lockdown Mode when the feature is active.
“To date, no known instance of hacking a device with Lockdown Mode has occurred: 'We are not aware of any successful mercenary spyware attacks against a Lockdown Mode-enabled Apple device'.”
Mode specifics and attack surface
Lockdown Mode isn’t cosmetic; Apple describes a sharpened attack surface that blocks most message attachments, disables certain complex web technologies, and prevents devices from automatically joining non-secure Wi‑Fi networks, among other limits. When activated, it disables 2G/3G cellular support on iPhone and iPad and dramatically reduces features that are commonly exploited by mercenary spyware. These changes shrink the attack surface, and security researchers have described Lockdown Mode in stark, fortress-like terms.
Nuance in the record
Despite Apple's public claim, the landscape remains nuanced: Amnesty International and Citizen Lab researchers have documented spyware attacks on iPhone users, but those analyses consistently show no bypass of Lockdown Mode in the instances that have been publicly described. Google researchers reportedly found that certain spyware would abort infection if Lockdown Mode was detected, suggesting attackers face a conditional barrier rather than a guaranteed one. Some outlets highlight that Lockdown Mode blocks or thwarts attacks on two documented cases: Pegasus and Predator.
“Google researchers found that the spyware would bail out of trying to infect the victim if it detects Lockdown Mode, likely as a way to evade detection.”
Policy implications and cautions
The new development may influence how journalists and other high-risk users assess risk and decide whether to enable Lockdown Mode, particularly as security patches reach older devices and as leaked tooling targets older iOS versions. Patches for outdated iOS versions are being pushed, and Lockdown Mode provides a protective option for those who cannot or will not update immediately.
However, the cost is usability: Lockdown Mode is a high-friction setting that blocks attachments, disables some web technologies, and alters routine connectivity, meaning users must weigh personal risk against practical use. Taken together, the statements from Apple and researchers imply Lockdown Mode raises the bar for targeted attackers, even as underground markets circulate exploits for older software.