Protect your devices

If you may be a target

Journalists, activists, lawyers and officials are the people this technique was used against. Do not wipe the device first, since that destroys evidence. Contact the Access Now Digital Security Helpline or your organisation's security team.

iPhone and iPad

• Settings, Privacy & Security, Tracking: turn off Allow Apps to Request to Track.
• Settings, Privacy & Security, Apple Advertising: turn off Personalized Ads.
• Install a Safari content blocker from the App Store.
• Settings, General, VPN & Device Management: remove any profile you do not recognise.
• Install iOS updates promptly. Consider Lockdown Mode (Settings, Privacy & Security) if you are high risk.

Android

• Settings, Privacy, Ads: choose Delete advertising ID where offered, and opt out of ad personalisation.
• Use Firefox with uBlock Origin, or Brave, for browsing.
• Set Private DNS (Settings, Network) to a filtering resolver you trust.
• Uninstall apps you do not use, especially free apps funded by ads.
• Review Settings, Apps, Special access, Device admin apps for anything unfamiliar.

Windows and desktop

The confirmed infections in the report were on Windows computers, reached through the browser. Keep the OS and browser fully updated and use uBlock Origin.

• Block the published domains at your router or DNS filter using the plain-text blocklist. One domain per line, subdomains included.
• Check for software or browser extensions you did not install.

Habits that help

• Restart your phone regularly, for example weekly. Some mobile implants do not survive a restart and must be re-delivered. A restart does not remove all spyware.
• Reset your advertising ID after a scare. It does not remove an infection, but breaks the link between old and new ad profiles.
• Keep a dated copy of the report you export here if you later ask a professional for help.