Apple warned users in 99 countries on October 29 about mercenary spyware activity, and now Thailand's government wants answers. Digital Economy and Society Minister Chaichanok Chidchob sat down with Apple representatives on Wednesday to discuss the alerts, several of which landed with Thai politicians, according to Bloomberg.

The meeting is the first step in a broader government response. Thai authorities will meet technology companies on Thursday to weigh the threat and potential responses, with Android-related risks also on the agenda, Bloomberg reported.

What did Apple actually detect?

In response to questions from Bloomberg, Apple confirmed it had detected activity consistent with mercenary spyware attacks and sent the notifications on October 29. The warnings went out worldwide, reaching recipients across 99 countries.

Mercenary spyware (commercially sold surveillance software deployed against specific high-value targets) differs from ordinary malware. It's expensive, targeted, and typically aimed at journalists, activists, lawyers and politicians rather than the general public.

Apple describes its warnings as "high-confidence alerts" but says it cannot achieve absolute certainty, according to AppleInsider. Since the program began in 2021, people in more than 150 countries have received these warnings, the company has said.

Chaichanok offered one important caveat. Getting a warning, he said, does not always indicate a device was actually breached, according to Bloomberg.

Is Pegasus behind the Thai alerts?

That's the question Thai politicians raised once the alerts arrived. So far, the answer is no — or at least, not proven.

Chaichanok said officials in Thailand have nothing linking the attempted attacks to Pegasus, the surveillance tool built by Israel's NSO Group, Bloomberg reported.

The suspicion wasn't baseless. Researchers reported in 2022 that Pegasus had been used against activists campaigning for democracy in Thailand. That history made the October alerts politically charged, even without a confirmed connection.

Why won't Apple explain its detection logic?

Apple refused to disclose what prompts it to send an alert. The company argues that revealing those details might let attackers modify their tactics and avoid being caught, according to Bloomberg.

That opacity cuts both ways. It protects the detection pipeline, but it leaves recipients — including sitting politicians — unable to independently verify whether their devices were compromised.

Apple's practical advice for anyone who receives a threat notification is twofold:

• Turn on Lockdown Mode (an optional iPhone setting that drastically restricts device features to block sophisticated attacks)
• Seek help from security experts

What happens next?

The timeline is short. Chaichanok described the Apple meeting as one in a series of discussions, according to AppleInsider. The ministry intends to collaborate with three groups:

• The National Security Council
• The National Cyber Security Agency
• Thai companies that build computing equipment and programs

The goal, he said, is to understand the full scope of the attacks before any security plan takes effect. He expects the plan to be finished during the week beginning November 16.

That gives Thai authorities roughly two weeks from the first meeting to a completed national response — a tight window for a threat they can't yet fully attribute, on platforms (Apple's iOS and Google's Android) they don't control.

The Thursday session with technology companies will determine how much cooperation Bangkok gets. Android-related risks sit on the agenda alongside the Apple alerts, which signals that the government views the October warnings as a cross-platform problem rather than a single-vendor incident.