Apple Warned Two Thai Party Leaders of Spyware: What It Means for Your Executives' Phones

อ่านภาษาไทย

Two Party Leaders, One Warning on Their iPhones

Within a single day this week, the leaders of two of Thailand's best-known political parties said the same thing had appeared on their phones: an Apple alert warning that they were being targeted by spyware.

On 2 November 2026, Democrat Party leader and former prime minister Abhisit Vejjajiva confirmed that Apple had sent him a threat alert about his personal iPhone. According to Thairath, he had the phone checked by experts with experience of similar attacks, and the first inspection found no sign that it had been successfully hacked. He switched on Apple's Lockdown Mode while he waits for a deeper examination.

The next day, People's Party leader Natthaphong Ruengpanyawut, the leader of the opposition, posted screenshots of his own "threat notification". As reported by CNA, it read: "Apple detected that you are being targeted by a mercenary spyware attack that is trying to remotely compromise the iPhone associated with your Apple Account." It added that the attack was likely aimed at him "because of who you are or what you do", and that notices had gone to targeted users in 110 countries.

What Is Confirmed, and What Is Not

It is worth being careful here, because a lot of the early coverage used the word "Pegasus". So far, nobody has confirmed which spyware was involved or who was behind it. Digital Economy and Society Minister Chaichanok Chidchob said on 3 November that Abhisit had spoken of malware rather than naming Pegasus, that Apple had not said which software was used, and that there was no evidence yet of Pegasus, as reported by Khaosod and Thai Post. The People's Party suggested a state actor could be responsible; a government spokesman called that insinuation baseless and said no budget had been allocated to buy such software.

The minister said the issue would go before the National Security Council on 4 November, and that his ministry was contacting Apple for more information. Deputy Minister Boonyathida Somchai added that the warnings had been sent in many countries, not only Thailand.

Why This Matters Beyond Politics

Apple's own guidance says the vast majority of people will never receive one of these alerts. Mercenary spyware is expensive and is aimed at a very small number of people, most often journalists, activists, politicians and diplomats. Apple describes its threat notifications as high-confidence alerts that should be taken very seriously, and advises anyone who gets one to turn on Lockdown Mode and seek expert help.

Most Thai business owners will never be in that small group. But the story is a reminder of something every company already knows and rarely acts on: the phone in a senior manager's pocket is often the most valuable data store in the whole business. It holds LINE groups with clients and the board, email, banking and payment apps, photos of contracts and ID cards, saved passwords and years of call history. That is exactly why someone would spend millions trying to get into one.

It also pays to listen to the everyday advice the minister gave the public on the same day. Alongside changing passwords and avoiding unknown links, he warned against public Wi-Fi and hotspots and against taking devices to repair shops you don't trust. That last point gets far less attention than it deserves. A phone handed over for a screen repair, or left in a drawer after an upgrade, can expose far more than a sophisticated attack ever will.

What This Means for Your Company

You cannot buy your way out of state-level spyware, and nothing in this article will stop an attacker who has already targeted someone. What you can control is the much larger and more ordinary risk: what happens to company phones and tablets before repair, after an upgrade, after a security scare and when people leave.

1. Take alerts seriously, and check them properly. Apple says genuine threat notifications never ask you to click links, open files, install apps or give your password or verification code. If an executive gets one, verify it by signing in at account.apple.com, then call in qualified security help before doing anything else.
2. Plan what happens to a phone you no longer trust. Many organisations decide that a handset caught up in a security scare should be replaced rather than kept. Once any investigation is finished, that old phone still holds everything that was on it, so it needs a certified wipe or physical destruction of its storage, not a factory reset and a trip to the second-hand market.
3. Don't send phones out for repair with data on them. Back up and wipe before a device leaves your hands, use repairers you can hold accountable, and keep a record of who had the device and when.
4. Keep a register of company phones and tablets. Know which handsets senior staff use, what is on them and where the old ones went after each upgrade cycle.
5. Close the loop when people leave. Departing directors and managers often hand back phones and laptops still signed in to company accounts. Those devices should go for laptop data destruction or a certified phone wipe before anyone else touches them.

Under Thailand's Personal Data Protection Act, companies must keep appropriate security measures in place for the personal data they hold, and that duty does not end when a device goes into a drawer. Our guide to PDPA data destruction requirements explains how disposal fits into those obligations, and why a factory reset is not enough on its own.

How We Can Help

Our phone and tablet data destruction service permanently removes LINE and other chat apps, banking and payment apps, saved passwords, photos and scanned documents, with a certificate for every device. You can choose a certified wipe and have the phone returned, or have its storage physically destroyed for the strongest guarantee. For larger clear-outs of phones, laptops and other company equipment, our IT asset disposal service handles the whole batch with a full inventory report. We handle electronic devices only; we do not shred paper.

Spyware alerts make headlines, but the phones your company has already retired are the risk you can deal with today. Get an instant quote or call 082-797-3702, and we will make sure the old phones and tablets used by your managers and staff are wiped or destroyed for good, before anyone else gets a look inside them.

Sources: Thairath English, Abhisit on Apple spyware alert (2 Nov 2026); CNA/AFP, Thai opposition leader targeted in spyware attack (3 Nov 2026); Khaosod, DE minister on "Mark-Teng" alerts (3 Nov 2026); Thai Post, no evidence yet of Pegasus (3 Nov 2026); Apple Support, About Apple threat notifications.