Apple has filed suit against Israeli cyber firm NSO Group and its parent, OSY Technologies, in California federal court. The complaint alleges NSO created more than 100 fake Apple ID credentials to target Apple customers in 2021—including U.S. Citizens—using its Pegasus spyware. Apple is also seeking a permanent injunction blocking NSO from using any Apple software, services, or devices, and has pledged $10 million, plus any damages, to cyber-surveillance researchers including Citizen Lab at the University of Toronto. The suit follows similar actions from Microsoft, Meta, Alphabet, and Cisco. Apple reports no evidence of Pegasus working against devices running iOS 15.
What Apple is actually arguing
The complaint paints NSO as a "21st-century mercenary" whose tools targeted government officials, journalists, activists, academics, and businesspeople. Apple alleges the company not only sold spyware but provided consulting services for attacks—undercutting NSO's defense that it merely sold a tool to vetted clients. Apple's head of security engineering, Ivan Krstić, called the practice incompatible with democratic principles. NSO disputes this, saying its technology supports American national security interests and that it operates "some of the most stringent compliance and human rights programs."
Our analysis
There are two fights here. The first is legal: if Apple proves NSO provided hands-on support for attacks rather than just selling a product, the "we just sold a tool" defense collapses. That matters for every jurisdiction where NSO operates.
The second is operational. The lawsuit notes NSO forces Apple into constant security updates to outpace its tools. Apple is betting it can stay ahead with features like Lockdown Mode. If it succeeds, enterprise mobile security gets a real boost. If it doesn't, the threat model for executives, legal teams handling mergers, and journalists with sensitive sources shifts permanently.
Business users should care because repressive governments can now outsource surveillance they couldn't build themselves. Confidential deal data, client communications, and personnel information become targets when employees carry these devices abroad.
Who should care
| Audience | Primary concern | Immediate action |
|---|---|---|
| Enterprise IT | Mobile devices are now attack surfaces for state-sponsored tools | Audit iOS update compliance across executive devices |
| Legal/compliance teams | Client confidentiality on mobile may need reassessment | Review travel policies for high-risk jurisdictions |
| C-suite | Board-level mobile risk, not just a technical footnote | Enable Lockdown Mode for high-exposure roles |
| Security teams | Apple funding of groups like Citizen Lab supports detection research | Monitor for mobile EDR alerts on profile installs |
A realistic sprint response
Say your VP asks, "Are we exposed?" You don't need to chase zero-days. A practical three-step sprint:
- Inventory high-risk roles** — anyone traveling to regions with documented surveillance abuse or handling confidential data on mobile.
- Push current iOS within days of each release** — Apple says it hasn't seen Pegasus work against iOS 15, but updates close other vectors.
- Enable Lockdown Mode** for the small set that needs it, and add a mobile EDR signal for suspicious profile installs. File that as a Definition of Done for any executive device.
What to watch next
Watch whether the court grants the injunction. That decides whether NSO can still touch Apple infrastructure. Watch iOS 15 adoption as a quiet defensive metric. And watch whether researchers publish more on the 100-plus fake Apple IDs—if that list names targets, every organization will have to assess exposure.
Key takeaways
- Pegasus is no longer just a journalist problem. It is a board-level mobile risk.
- Lockdown Mode and fast iOS updates are the realistic enterprise response.
- A court injunction matters more than damages, because it removes NSO from Apple's ecosystem.
- Apple joins Microsoft, Meta, Alphabet, and Cisco in holding NSO accountable.
Frequently asked questions
Did Apple itself get hacked in the NSO case?
No. Apple's servers were not breached. The complaint alleges Apple IDs and services were misused to deliver attacks on users.
Is iOS 15 enough to block Pegasus?
Apple says it has not seen evidence of Pegasus working against devices running iOS 15. That is a statement of current observations, not a permanent guarantee.
What should a normal IT team actually do this week?
Force updates on executive iPhones, turn on Lockdown Mode for high-risk roles, and review any travel to regions known for surveillance abuse.
Why is the fake Apple ID detail important?
More than 100 spoofed identities suggests an organized, sustained program rather than one-off targeted attacks, potentially revealing a broader scope of victims.