Apple Spyware Incident Response Workbench

1. Threat Notification Verification EVALUATING

Target Profile & Role

Target Device & OS

Observed Verification Indicators

appleid.apple.com Web Banner
A red threat notification banner appears at the top when logging into appleid.apple.com directly.

Verified Sender
iMessage or email delivered from threat-notifications@apple.com with valid DKIM/SPF.

No Unsolicited Links/Credentials Requested
Apple's notification NEVER asks you to click a link to verify credentials or provide a 2FA code.

Urgent SMS Asking for Login (Phishing Sign)
Received SMS urging immediate login to an external domain or requesting Apple ID passcode.

STATUS: AUTHENTIC APPLE THREAT ALERT

Corroborated across authenticated Apple ID portal and direct signed telemetry. High likelihood of state-sponsored mercenary spyware targeting (Pegasus, Predator, Reign).

Remediation Progress (0%)

Civil Society Escalation Channels

If you are a confirmed high-risk target, verify chain of custody before submitting artifacts to trusted independent forensic centers:

Citizen Lab	Munk School, Univ. of Toronto	PGP Verified
Amnesty Tech	Security Lab (MVT tools)	Forensic Lab
Access Now	Digital Security Helpline (24/7)	Emergency

2. Priority Containment & Evidence Preservation Protocol 0 of 4 Completed

STEP 01 // IMMEDIATE VOLATILE PRESERVATION

Do NOT Power Off or Reboot (Keep in Charger)

Mercenary spyware such as Pegasus or Predator often executes strictly in memory (RAM). Powering down destroys volatile memory forensic artifacts and triggers un-jailbroken states that complicate extraction.

⚠️ Keep the device plugged into power. Do not restart unless Lockdown Mode forces a controlled single reboot after diagnostic capture.

Device connected to power; volatile state preserved; device not manually power-cycled.

STEP 02 // NETWORK ISOLATION

Enable Airplane Mode & Isolate SIM / Cellular

Sever attacker command-and-control (C2) channels and remote data wipe commands while maintaining the current device state.

Settings -> Airplane Mode [ON] | Wi-Fi [OFF] | Bluetooth [OFF]

If eSIM is active, ensure cellular line is toggled OFF. If physical SIM, remove SIM tray using an extraction pin.

RF isolation confirmed (Airplane mode ON, Wi-Fi disabled, Bluetooth disabled).

STEP 03 // FORENSIC LOG EXTRACTION

Trigger iOS Sysdiagnose & Encrypted Backup

Generate a system diagnostic log before applying updates or rebooting. Sysdiagnose packages crash logs, socket stats, and kernel state critical for MVT analysis.

Press & hold Volume Up + Volume Down + Power button for 1-1.5 seconds until brief vibration occurs.

Log generation takes 1-3 minutes. Retrieve archive via AirDrop (momentary peer connection) or local Finder/iTunes backup to an offline forensic workstation.

Sysdiagnose combination triggered and full local encrypted backup initiated.

STEP 04 // HARMONIZED REMEDIATION

Engage Lockdown Mode & Secondary Credential Rollover

Lockdown Mode blocks zero-click iMessage attachments, complex web technologies (JIT compilation), shared photo albums, and incoming FaceTime requests from untrusted senders.

Settings -> Privacy & Security -> Lockdown Mode -> Turn On Lockdown Mode -> Restart Device

🔑 Critical Credential Isolation: From a known-clean secondary computer, change Apple ID password, revoke existing iCloud web sessions, and rotate all high-value email / messaging tokens.

Lockdown Mode enabled across all Apple devices; credentials rotated from secure secondary terminal.

3. Generated Incident Response Dossier ID: SEC-2026-APL-01

Generating incident brief...