Apple, Google, and WhatsApp tools to fight spyware

Spyware attacks on journalists, human rights defenders, and political dissidents are no longer rare or exotic. For the last 15 years, security researchers have documented cases of these targeted campaigns. In early 2025, WhatsApp notified roughly 90 users—many of them journalists and civil society members across Europe—that they had been targeted by Paragon Solutions, an Israeli spyware company. Some targets were hit with a zero-click attack, which is a method requiring no user interaction to compromise a device. In response to these threats, tech giants now offer specific opt-in features to counter spyware.

Apple provides Lockdown Mode, an opt-in security feature that reduces a device’s attack surface by limiting certain functionalities. According to research organization Citizen Lab, Lockdown Mode stopped one spyware attack carried out with Pegasus software, which is made by NSO Group, a spyware maker. In March, Apple stated it has never detected a successful attack on an Apple device with Lockdown Mode enabled.

When enabled, Lockdown Mode changes several device functions:

• Blocks most iMessage attachments other than specific images, video, and audio.
• Disables link previews in iMessage.
• Blocks certain web technologies, fonts, and images in Safari.
• Blocks incoming FaceTime calls from unknown contacts.
• Prevents automatic connection to open or non-secure Wi-Fi networks.
• Blocks connections to 2G and 3G cellular networks.

Google offers two layers of defense. The first is the Advanced Protection Program, launched in 2017 to secure Google accounts. The second is Android’s Advanced Protection Mode, which brings mobile-specific defenses to the operating system.

Android’s Advanced Protection Mode includes the following features:

• Enables Google Play Protect to scan for harmful behavior.
• Blocks app installations and updates from unknown sources.
• Blocks USB connections when the device is locked.
• Blocks connections to 2G networks.
• Automatically reboots the device if it has been locked for 72 hours, making data extraction more difficult.

WhatsApp, which is used by more than 3 billion people, has also been targeted by spyware makers. In 2019, WhatsApp caught a hacking campaign by NSO Group that targeted around 1,200 users. To protect its users, WhatsApp launched Strict Account Settings.

On Android and iOS, Strict Account Settings enables:

• Two-step verification and security notifications.
• Default blocking of attachments and media from unknown senders.
• Disabled link previews and silenced calls from unknown numbers.
• Hidden IP addresses during calls.
• Restricted visibility of profile photos, online status, and group invitations to people who are not contacts or members of a pre-established group.

Security experts emphasize that these built-in tools represent the most effective defense currently available to the public. “These features are free, easy to enable, and the best defense we have today against sophisticated spyware,” said Runa Sandvik, a security researcher who has worked to protect journalists and other at-risk communities for more than a decade.

Why it matters

As spyware becomes a standard tool for targeting civil society, these free, opt-in features provide a critical, accessible layer of defense for high-risk users and the general public alike.