There are days that begin with joy and end somewhere entirely unexpected. This was one of them.

I had been waiting months for my new Mac Mini. Months. Anyone who knows me knows that I approach new creative equipment with a particular kind of anticipation — not quite the excitement of a child on a birthday morning, but something in that general direction. The day it finally arrived, we were setting it up, cables everywhere, that particular quiet satisfaction of new hardware coming to life, when an email arrived.

The subject line stopped me cold.

It was from Apple. And it informed me, with clinical precision, that my iPhone was being targeted by a mercenary spyware attack.

My first thought, naturally, was: this is a scam. An obvious phishing attempt. I have seen enough of those to recognise the genre. So I did the sensible thing and called Apple directly. I read the email aloud to a very pleasant member of the UK technical support team, who listened patiently and then told me, with reassuring confidence: “It sounds like a scam. Nothing to worry about. We don’t send out things like that.”

I was almost convinced. Almost. And then I asked her one question that changed the tone of the conversation considerably: how could it be that I was receiving this message simultaneously on my recovery email addresses — accounts that are not publicly associated with my Apple ID?

A brief pause.

“There is only one way to know for certain,” she said. “Log in to account.apple.com and check.”

I did. And there it was — unmistakeable, in red, at the top of the page:

Threat Notification. Apple sent you a threat notification via email and iPhone alert on August 13, 2026.

I have experienced unsettling moments in my life. Moments of shock, of grief, of disorientation. But this was something different. This was the feeling of violation — the particular, cold realisation that someone had been inside something deeply private. Not a house. Not a bag. A phone. The device that carries your conversations, your thoughts, your creative work, your family, your most trusted relationships.

And then it truly sank in. This was not simply a breach of data. Someone had been sitting with me — silently, invisibly — in every room I had entered. In my bedroom at night. In private conversations with my wife. In creative moments I believed were entirely my own. In calls with people who trusted that our exchange was between us alone. The intimacy I had assumed was, for some period of time, not intimacy at all. It was a performance — witnessed, without my knowledge or consent, by unseen eyes and ears. That feeling is not easy to describe. I will simply say: it was a violation unlike anything I have previously experienced.

I immediately contacted the relevant organisations and NGOs whose work is precisely this — supporting individuals who find themselves targeted by sophisticated digital threats. I should say clearly, and I will say it only once: this is a sensitive matter, and there are details I am not in a position to share publicly. I hope you will understand and respect that.

The next three weeks were, not to put too fine a point on it, exhausting. My wife and I both fell ill — almost certainly COVID, the kind that takes weeks rather than days to fully shake, the kind that leaves you feeling like you are moving through water. So there I was: physically depleted, mentally occupied with something I could not fully discuss, and carrying questions that had no immediate answers. Had my phone been hacked? If yes, when had it started? Was it still happening? Who would go to these lengths, and why? Was it a government? An intelligence agency? And if so — which one?

The NGOs were exceptional. They asked me to carry out specific diagnostic procedures, provide certain files, and submit limited backups — not only from my own devices, but from those of my immediate family and team members as well. I followed their guidance precisely.

Then came the moment I had been quietly dreading: the results.

I will not pretend it was easy news to receive. My phone had indeed been compromised — for some period of time, by what the evidence pointed to almost certainly being a state-level intelligence operation. The remaining details I am not at liberty to share, at least not yet. What I can tell you is this: none of my immediate family members’ or team members’ devices had been affected. And my phone, at the time of investigation, was no longer actively infected.

Steps were taken. Precautions were implemented. And here I am.

Now. For those curious about the mechanics of what happened.

The how first. This was what is known as a clickless attack — meaning no link was clicked, no attachment opened, no moment of human error exploited. It simply happened, silently, invisibly, without my knowledge or participation. And this matters enormously, because it tells you something about the nature of what we are dealing with. Attacks of this kind cost millions of dollars to execute. The infrastructure required is extraordinary. This is not opportunistic crime. This is deliberate, targeted, and very well resourced.

The what next — and this is the part I want you to sit with for a moment. Once a device is compromised in this way, the attacker does not merely have access to your messages or your emails. They have access to everything. Every conversation you have had, every photograph, every document, every contact, every note written in a private moment. They can activate your microphone without your knowledge — listening to every conversation in every room you enter, every phone call, every whispered exchange with someone you love. They can activate your camera without the indicator light ever turning on. They can watch. They can listen. They are, in the most visceral sense of the phrase, in the room with you — in your bedroom, in your car, in your bathroom, in your most private and unguarded moments — and you have absolutely no way of knowing. None. There is no notification. There is no sign. There is only the terrible, retroactive realisation that the intimacy you believed you had was, for some period of time, an illusion.

I do not say this to frighten. I say it because it is the truth, and the truth is the only place from which any meaningful response becomes possible.

The why is the part I find, in a strange way, the most clarifying. My work, my voice, and my conscience have consistently stood on the side of the oppressed, the forgotten, and the dispossessed — wherever they are, whoever they are. I will not be more specific than that, because I suspect I do not need to be. Those who know my work will understand immediately. Those who have been following closely will have already drawn their own conclusions. What I will say is this: if the price of speaking with an honest conscience is that certain powerful entities find you inconvenient enough to spend millions of dollars listening to your phone calls — then that is a price I accept without hesitation, and carry without shame. In many ways, this violation is a form of confirmation. It tells me that the work matters. That the voice, however modest, has been heard in places that would have preferred it remain silent.

I will continue. That was never in question.

Now to the part that matters most for you.

Whether or not you are a public figure, whether or not you have any reason to believe you are a target — the digital landscape has changed, and the habits that were sufficient five years ago are no longer sufficient today. I am sharing below a set of practical steps, recommended by the organisations who helped me, that will make it significantly — not impossibly, but significantly — more difficult for any malicious actor to access your devices. It will take you no more than ten to fifteen minutes. Please do it.

For iPhone users:

The single most important step is to enable Lockdown Mode: Settings → Privacy & Security → Lockdown Mode. Turn it on. It takes moments and offers the strongest available protection for individuals who may be targeted.

Beyond that: use a strong custom alphanumeric passcode rather than a numeric PIN; disable USB accessories when locked (Settings → Face ID/Touch ID & Passcode → USB Accessories → Off); enable two-factor authentication for your Apple ID; turn on Advanced Data Protection (Settings → [Your Name] → iCloud → Advanced Data Protection); restrict location services aggressively on a per-app basis; and keep your software updated without delay. If you press the power button five times rapidly, you instantly disable face unlock — worth remembering.

For Android users:

If your device runs Android 16, enable Advanced Protection Mode — a recently introduced high-security setting that significantly raises the cost of compromise. If you are not yet on Android 16, update when you can and enable it immediately.

For all messaging apps:

In Signal: enable Always Relay Calls (Settings → Privacy → Advanced), enable disappearing messages by default, and disable link previews. In WhatsApp: protect your IP address in calls (Settings → Privacy → Advanced), enable disappearing messages by default, and disable link previews.

For email and accounts:

Enable Google’s Advanced Protection Programme if you use Gmail. Enable Microsoft AccountGuard if you use Microsoft services. Enable Proton Sentinel if you use Proton. These programmes exist precisely because certain people are more likely to be targeted than others, and they offer meaningful additional layers of protection.

A note on VPNs: they help, but they are one ingredient, not the whole meal. If you use one, Mullvad VPN is a reputable and honest choice — they do not overstate what they can do, which is itself a form of trustworthiness.

I share all of this — the disruption, the violation, the weeks of uncertainty — not to alarm, and not to perform courage I do not feel. I share it because silence serves no one, and because there are practical things every single person reading this can do to make themselves significantly harder to target.

And then I want you to do something else. I want you to think — genuinely think — about what it would mean to discover that someone has been silently present in every room you have occupied for weeks or months. Not a metaphor. Not a thriller plot. A real human being, or a team of them, sitting behind a screen somewhere, with access to the most intimate corners of your life. Your conversations with your spouse at midnight. Your creative thoughts spoken aloud to yourself. Your children’s voices. Your prayers. Your moments of doubt and your moments of tenderness. All of it — heard, seen, recorded, by someone who was never invited and never announced themselves.

That is what this technology enables. And it is being used. Right now. Against people in every country, at every level of public life. The only sane response — beyond the practical steps above — is a clear-eyed awareness that the devices we carry are not neutral objects. They are windows. And windows, as it turns out, can be opened from the outside.

I came through this episode intact, grateful, and — if I am honest — more resolved than before. Not shaken into silence. Sharpened into clarity. The voice that certain entities found inconvenient enough to surveil is the same voice that will continue, without apology, to speak for those who need it spoken for.

Now, I would love to hear from you — though only if you feel comfortable doing so. If you have experienced something similar — a breach, a violation, a moment of discovering that something private was no longer entirely your own — I would be honoured to hear about it, in whatever detail feels right. And if you have not experienced anything like this, I am genuinely curious: does knowing that this technology exists, and that it is actively being used, change how you think about the devices in your pocket?

There is no obligation to share. But if something in this story has moved or unsettled you, the Majlis is a safe and warm space to bring it. I will be reading every word.

One final thing, and I say this with real conviction: please consider enabling Lockdown Mode on your iPhone today. I would go further and recommend keeping it enabled permanently, as a default rather than an emergency measure. The security it provides far outweighs any minor friction, and for anyone who values their privacy, the peace of mind alone is worth it.

Please take the steps. All of them. It will not take long, and you will not regret it.

With so much love, and a phone that is now rather better protected than it was a month ago, 

Sami 💛