Apple Warns Activists They Are Being Watched by Spyware

Apple has alerted several government critics in Thailand that their iPhones have likely been targeted by “state-sponsored attackers.” 

Messages were sent to at least six people on Nov. 24, only hours after the tech giant announced it was suing Israeli spyware firm NSO Group and its parent company OSY Technologies.

Activists in El Salvador and Uganda also received messages from Apple on the same day. Recently blacklisted by the U.S. government, NSO Group has become embroiled in controversy over its military-grade spyware Pegasus technology, used by major rights abusing states worldwide to target journalists and human rights activists. It was not immediately clear if Pegasus was used in this instance in Thailand, but it was previously detected in the country in 2018. 

Among those who received warning emails from Apple was Thai rapper Dechathorn Bamrungmuang—a founder of the Rap Against Dictatorship collective and better known by his stage name Hockhacker.

Dechathorn was one of several high-profile pro-democracy activists arrested last year on a range of charges at the height of large-scale anti-establishment protests that rocked Thailand for much of 2020. The rapper told VICE World News that he received a warning email from Apple on early Wednesday morning. Identical messages were sent to other Thai activists and government critics. 

“Apple believes you are being targeted by state-sponsored attackers who are trying to remotely compromise the iPhone associated with your Apple ID,” the email read. “While it’s possible this is a false alarm, please take this warning seriously.” 

Apple also warned that attackers “may be able to remotely access your sensitive data, communications, or even the camera and microphone.” 

Dechathorn said that he was paranoid and was “constantly checking” apps on his iPhone to make sure they were safe. His Facebook and Instagram accounts, often critical of Thailand’s government, have tens of thousands of followers. 

“I am preparing steps to [protect myself] from hacking spyware,” Dechathorn said.

Dechathorn and other vocal government critics have been subject to a campaign of intimidation and harassment by Thai authorities. Reports last week showed a leaked police file in which a request was made to revoke his passport—a request that was seemingly approved as Dechathorn tweeted on Thursday that the document had been invalidated.

Five others were targeted, with police justifying the act by saying their activism was “against the constitution.”

“Last week it was leaked documents about my passport, and this week came the email from Apple about hacking spyware,” he said prior to the confiscation.

He did not rule out the possibility of Thai government interference in this latest case. “They have the power to control things,” he said. “It’s affected activists and all those who are against them and I don’t know if things will get worse.”   

Another activist, a man in his 20s who declined to be named for fear of retaliation from authorities, told VICE World News that he had received the same email from Apple and immediately changed the passwords on his chat apps and social media accounts. 

Others targeted included a political scientist at Bangkok’s Thammasat University and members of legal monitoring group iLaw. 

NSO’s Pegasus spyware can infect both iPhones and Android devices, allowing operators to extract messages, photos and emails, record calls and secretly activate microphones and cameras. The group argues that its tools were made to target terrorists and criminals, but recent investigations have found its spyware being used on activists, politicians and journalists.

Apple’s lawsuit seeks to prevent the Israeli firm from using Apple products. In a blog post published on Monday, the iPhone maker said that it intends to hold NSO Group and OSY Technologies “accountable for the surveillance and targeting of its users.”

Follow Heather Chen on Twitter.