I wouldn’t be surprised if Apple’s malware notification comes via the same or similar mechanism as Apple 2FA codes on iOS, as iMessage itself is a common vector for these kinds of malware being warned of, such as Pegasus. Apple also notifies you of this kind of malware via the email used for your AppleID, in addition to on-device, though I wouldn’t be surprised if that same malware would attempt to monitor for these messages from Apple to prevent them from being received and/or read.

The Apple Support app, for example, has capabilities which when triggered from the Apple side, allow screen-sharing and logging to be shared with Apple. I don’t know if this functionality relies on iMessage being enabled either, but I do know that the Apple Support app seemingly still works in Lockdown Mode.

I’d be curious if the person in TFA had their device in Lockdown Mode, which supposedly is supposed to make these kinds of exploits harder to install. If they were using Lockdown Mode, and they still got exploited, that isn’t great news for the rest of us, but the fact that Apple notified them is better than the alternative of Apple not being aware of the breach and/or Apple being aware and not notifying them for reasons.

Apple has the capability to remotely disable iPhones, which has been used when large numbers of iPhones were looted during riots in the US. I’m not sure if that capability relies on the devices not already being activated or not, but I’ve seen credible screenshots of the message when iPhones are so disabled.

If I got a message in my iPhone saying it had been remotely disabled, I would take it to an Apple Store or authorized Apple Service Center, where they could tell me what should happen next. This would be inconvenient, to be sure, but it would be preferable to continuing to use the device.

Well, it blocked the exploit. If the adversary knows the exploits blocked, their cover is burnt. What do they do?

push notification + out of band comms would be more ideal, time sensitivity is significantly important.