Apple's spyware alert tells you almost nothing. Write the runbook anyway.

Apple sent another round of mercenary spyware threat notifications on August 13, telling selected iPhone users they had been individually targeted, according to John Scott-Railton, a senior researcher at the University of Toronto's Citizen Lab ^[1]. Apple updated its threat-notification guidance the same day ^[4], and the two together leave mobile security owners with an awkward operational fact: the alert does not name the spyware vendor, the operator behind the attack, or the activity that triggered Apple's detection ^[7]. That is deliberate. Apple says publishing those details would help operators change their methods and evade detection ^[8]. The consequence for you is that the first three steps of a normal malware runbook, identify the family, pull indicators, sweep the fleet, are unavailable on day one. What you have instead is a high-confidence statement that a specific person was targeted, often because of who they are or what they work on ^[5], of the kind that has historically gone to journalists, activists, politicians and diplomats ^[6]. Apple says it has sent these notifications several times a year since 2021 and has reached users in more than 150 countries ^[9], and it has not said how many people or countries were in the August 13 round ^[10]. So write the path for a person, not a device image. Step one is verification, done without touching links or attachments in the message. Apple says a genuine warning appears on the targeted user's iPhone, on the Lock Screen and in Settings, and that Apple emails addresses associated with the Apple Account ^[11]; a copy should also sit at the top of account.apple.com after sign-in ^[12]. That is three independent places to check ^[13]. If nothing appears in Settings or on the account page, treat the message as a possible impersonation and route it to a security expert ^[12]. Apple's notifications never ask anyone to open a file, install an app or configuration profile, hand over an Apple Account password, or read back a verification code by email or phone ^[14]. A forged warning is an unusually strong phishing pretext precisely because the recipient already believes they are under surveillance ^[15]. Step two is preservation. Do not let the reflex to wipe and reissue win: users should keep the warning and get advice before erasing, replacing or heavily modifying the device, because a specialist may need device records to work out what happened ^[16]. Step three is escalation to someone who does this work. Apple's guidance points notified users to the Digital Security Helpline run by Access Now, which offers free round-the-clock incident response for qualifying civil society members including journalists, activists and human rights defenders ^[17]. Note the limit before you build a dependency on it: Access Now is not part of Apple's detection process and does not learn why Apple flagged a given account ^[18]. Step four is hardening. Apple and Scott-Railton both recommend Lockdown Mode for recipients and for people with credible reason to expect sophisticated targeting ^[19]. It restricts message attachments, complex web technologies, unfamiliar FaceTime calls, service invitations, wired device connections and configuration profiles ^[20], and it is enabled under Settings, Privacy and Security, Lockdown Mode, after which the device restarts ^[21]. Apple advises updating everything to the latest software first and turning the mode on separately per iPhone, iPad and Mac; enabling it on an iPhone also enables it on a paired Apple Watch ^[22]. It will break some websites, messages and Apple services ^[23], which is the point, and which is why the help desk needs to know about it before the tickets arrive. Scott-Railton's advice to recipients, delivered in a six-post thread on X, was to get expert help immediately rather than handle it alone ^[2]; he cited NSO Group's Pegasus as an example of the technology used in government-linked surveillance ^[3].