Apple warns Abhisit and Nattapong of spyware attacks. Government admits past requests to buy Pegasus but denies involvement. With a December censure debate looming, ministers seek answers. No successful hacking has been confirmed. Security chiefs prepare to act.
Apple spyware warnings to two Thai opposition leaders have raised fresh questions about political surveillance. Former Prime Minister Abhisit Vejjajiva and People’s Party leader Nattapong Ruangpanyawut received alerts within 24 hours. Digital Economy and Society Minister Chaichanok Chidchob denied evidence of Pegasus involvement. However, the government admitted Thai agencies previously sought funding to buy the Israeli spyware. The warnings come ahead of a no-confidence debate against Prime Minister Anutin Charnvirakul and amid restrictions on parliamentary investigations. Previously, Pegasus infected phones belonging to at least 30 Thai activists. Neither politician has confirmed a successful intrusion, while the National Security Council was due to examine the matter on Wednesday.
Thailand’s government faces a growing surveillance controversy after two opposition leaders received Apple warnings about sophisticated spyware attacks. On Tuesday, November 3, Digital Economy and Society Minister Chaichanok Chidchob denied evidence linking the incidents to Pegasus spyware.
However, a government spokesman acknowledged that Thai state agencies had previously sought funding to purchase the Israeli surveillance technology.
The disclosures come ahead of a December no-confidence debate against Prime Minister Anutin Charnvirakul’s government. They also coincide with restrictions on parliamentary investigations, which opposition leaders claim could obstruct scrutiny of the administration.
Apple spyware warnings hit Abhisit and Nattapong as Thailand confronts its Pegasus surveillance past
Democrat Party leader and former Prime Minister Abhisit Vejjajiva confirmed receiving an Apple security warning on Monday, November 2. A day later, People’s Party leader Nattapong Ruangpanyawut disclosed a similar notification.
Both warnings concerned sophisticated attempts to penetrate their mobile telephones. Nevertheless, neither politician has established that his device was successfully compromised. Nor has any forensic investigation publicly identified the software or operator responsible.
The controversy has revived attention to Pegasus, developed by Israel’s NSO Group. Previously, forensic investigators identified the spyware on telephones belonging to at least 30 Thai activists, lawyers and academics.
Those infections occurred between October 2020 and November 2021, during widespread pro-democracy demonstrations. Investigators confirmed the intrusions but never conclusively identified their operators. The latest warnings have consequently reopened questions about Thailand’s documented history of political surveillance.
Chaichanok addressed the controversy during an official visit to Udon Thani province on Tuesday. Speaking at the Montathip Hall Convention Centre at 11.30 am, he rejected claims that Pegasus had already been identified.
Chaichanok rejects Pegasus claims as government seeks Apple’s help and prepares security council talks
Instead, the minister stressed that Apple’s warnings did not establish which surveillance technology had been deployed. His ministry also possessed no evidence connecting the incidents to Thai security agencies.
In response, Chaichanok confirmed that officials were contacting Apple for additional information. The government also planned to raise the matter at Wednesday’s National Security Council meeting.
However, he declined to announce countermeasures before consulting the relevant security agencies. Officials first needed technical information establishing the nature of the attempted intrusions.
The minister referred to Apple warnings affecting users across 99 countries. He described the incidents as part of an international cybersecurity problem. By comparison, Nattapong’s published notification referred to targeted users in 110 countries.
Apple’s broader guidance records similar warnings reaching users in more than 150 countries since 2021. These figures concern different notification periods and surveillance campaigns.
Ministry seeks original Apple alerts from opposition leaders before launching detailed spyware inquiries
Chaichanok urged the politicians concerned to provide information so authorities could investigate. Subsequently, officials could determine whether further security measures were necessary.
He also confirmed consultations with cybersecurity specialists, major technology companies and countries experienced in countering sophisticated digital attacks. No specific investigation into the two politicians’ devices had yet been announced.
Separately, Deputy Digital Economy and Society Minister Nan Bunthida Somchai disclosed that neither politician had contacted her ministry directly. Instead, officials had obtained their information entirely from news reports.
Consequently, investigators had not received the original notifications or technical evidence from either opposition leader. The ministry was therefore seeking direct access to the warnings before proceeding.
Nan Bunthida said authorities wanted the politicians to submit their notifications for examination. Initially, officials needed to establish whether the messages genuinely originated from Apple.
Once authenticated, the ministry could contact the company for further details. She stressed that officials were requesting cooperation rather than demanding information. Nevertheless, the government needed the original warnings to pursue a detailed inquiry.
Government admits earlier Pegasus purchase requests but denies recent funding or involvement in attacks
The deputy minister also disclosed that government agencies had been discussing cybersecurity alerts since October 30. Those meetings covered spyware, malware and other threats affecting users internationally.
According to Nan Bunthida, Germany appeared to have received the most warnings in the latest reports examined. Her ministry was also coordinating with relevant agencies, including the cyber police. However, no criminal proceedings involving the two politicians’ telephones had been announced.
On another front, government spokesman Ekkapob Pianpises rejected suggestions that Thai authorities were responsible for the attacks. Speaking to AFP on Tuesday, he described the insinuations as baseless. Yet Ekkapob also disclosed previous government interest in Pegasus. Thai state agencies had submitted budget requests to acquire the Israeli surveillance software.
The spokesman insisted that no Pegasus funding had been allocated during the current or preceding financial year. However, he did not identify the departments responsible for earlier procurement requests.
Nor did he disclose their dates, proposed expenditure or final outcomes. The admission established previous official interest in the technology without confirming whether any purchase occurred.
Abhisit confirms spyware warning after former MP reveals attempted intrusion into his personal iPhone
The absence of recent allocations does not establish whether older requests resulted in acquisitions. Equally, no evidence has connected those applications to the latest Apple warnings.
The government has not disclosed whether Thai agencies previously obtained Pegasus through other arrangements. In parallel, AFP reported that neither Apple nor NSO Group responded to emailed questions on Tuesday.
The controversy began gathering momentum on Monday when Abhisit confirmed receiving an Apple security notification. The Democrat Party leader spoke at Bangkok’s Queen Sirikit National Convention Centre at approximately 2.30 pm.
Earlier, former Songkhla MP Sirichok Sopa had disclosed that Abhisit’s personal telephone was targeted by sophisticated surveillance software. The reported attack was intended to obtain private information.
Abhisit subsequently confirmed the warning. According to his account, Apple suggested that his professional activities and political responsibilities might explain the targeting. The notification concerned sophisticated surveillance capabilities rather than an ordinary malware campaign. However, Apple did not identify the operator or establish that Pegasus was involved.
Former prime minister activates Lockdown Mode but preliminary checks find no successful phone intrusion
The former prime minister arranged an initial examination of his iPhone by individuals familiar with similar attacks. Their inspection found no evidence of successful penetration. Nor did they identify damage or abnormal behaviour.
Nevertheless, a comprehensive forensic investigation had not been completed. The exact nature of the attempted intrusion therefore remained unresolved.
As a precaution, Abhisit activated Apple’s Lockdown Mode. The security feature restricts certain telephone functions to reduce exposure to sophisticated attacks. He later resumed normal use after preliminary checks revealed no abnormalities. Asked about a possible connection to parliamentary scrutiny, Abhisit acknowledged concerns surrounding the timing. However, he stopped short of accusing any government agency.
The Democrat Party leader stressed that authorities were responsible for protecting citizens against cyberattacks. He also expressed the expectation that state agencies would not engage in unlawful surveillance.
Notably, Abhisit declined an offer of government involvement in examining his telephone. He did not publicly identify anyone suspected of ordering the attempted intrusion.
Nattapong reveals second Apple warning and questions timing of parliamentary restrictions and censure
The following day, People’s Party leader Nattapong Ruangpanyawut revealed a comparable Apple warning. He published a screenshot of the notification on his personal Facebook account.
According to the message, his iPhone had been individually targeted by sophisticated spyware. The disclosure placed Thailand’s two leading opposition figures at the centre of the controversy.
Nattapong immediately questioned the political circumstances surrounding the warnings. He identified three developments that concerned him. First came tighter controls over parliamentary committee investigations.
Next were delays surrounding the opposition’s no-confidence debate. Finally, two opposition leaders had received spyware notifications within a short period.
Furthermore, Nattapong suggested that other politicians might have received similar warnings without disclosing them. However, he identified no additional confirmed recipients.
Nor did he produce evidence establishing that the attempted intrusion originated from a Thai government agency. His comments came amid a parliamentary dispute over scrutiny of Prime Minister Anutin Charnvirakul’s administration.
House Speaker’s committee restrictions trigger opposition fears of government control over inquiries
House of Representatives Speaker Sophon Saram has introduced changes affecting the chamber’s 35 standing committees. Under the measures, committee chairmen face restrictions on independently launching investigations or summoning witnesses.
The changes also strengthen procedural controls over overlapping inquiries. Opposition politicians argue that government MPs could use the rules to block investigations.
The dispute has intensified amid parliamentary inquiries into gambling operations and suspected money laundering. Some investigations have reached individuals connected to the governing Bhumjaithai Party. Consequently, the restrictions have become a major confrontation between government and opposition MPs. The controversy also involves proposed amendments that could strengthen coalition control over committee proceedings.
On Tuesday, Abhisit separately criticised the Speaker’s changes during an interview at noon. He warned that requiring majority approval for committee business could undermine parliamentary oversight. Government MPs controlled majorities on almost every standing committee, he noted. As a result, coalition members could prevent investigations simply by voting against proposed inquiries.
Abhisit warns majority voting rules could block parliamentary scrutiny and strengthen coalition power
Abhisit argued that such restrictions risked violating the constitutional purpose of parliamentary oversight. Instead, he favoured procedures allowing committee members to discuss objections without requiring formal votes on every matter.
He said rigid voting requirements could prevent investigations from proceeding. His concerns extended beyond individual inquiries to the operation of the entire committee system.
The former prime minister also criticised proposed amendments to parliamentary regulations. He warned that changes supported by Bhumjaithai MPs could increase government control over committee chairmanships.
Previously, disputes had generally been resolved through negotiation and acceptance of different political roles, he said. However, tighter regulations could place investigative decisions under effective coalition control.
Abhisit maintained that opposition MPs must retain their ability to scrutinise government decisions despite being outnumbered. Even so, he favoured negotiation rather than immediate confrontation with the Speaker. Opposition whips had discussed the matter that morning. However, Abhisit had not attended and could not confirm their conclusions.
Opposition links surveillance concerns to committee row but no evidence connects the two controversies
The parliamentary dispute provides the political background to the spyware warnings. Nevertheless, no evidence has established a connection between the committee restrictions and the attempted intrusions. Neither Apple nor independent forensic investigators have identified a political motive behind the latest incidents.
Elsewhere, former People’s Party MP Wiroj Lakkhanaadisorn challenged the government over the surveillance reports. On Tuesday, he demanded explanations concerning possible spyware use against opposition politicians.
Wiroj referred to previous information operations and accusations that political opponents had been monitored. He also questioned whether Pegasus deployment would comply with Thailand’s Personal Data Protection Act.
The former MP stressed that Pegasus was not ordinary consumer software available for private purchase. Consequently, confirmed use would raise questions about the operator and its authority. However, no forensic examination has established that Pegasus was responsible for either warning. Wiroj’s comments therefore concerned the implications of a possible deployment rather than an identified attack.
People’s Party prepares December censure debate as officials question possible state-backed spyware
The People’s Party is preparing for a no-confidence debate expected between December 7 and 11. Proceedings could involve scrutiny of 18 government office-holders. Wiroj insisted that the party remained confident about protecting its confidential information.
He maintained that attempted surveillance would not compromise its parliamentary preparations. The party has not disclosed whether additional security measures followed Nattapong’s warning.
People’s Party deputy spokesperson Napath Narangsiya also provided details to AFP. He said Nattapong was the only party member receiving a warning on Tuesday.
However, Napath recalled similar notifications sent to politicians and political staff under former Prime Minister Prayut Chan-o-cha. He acknowledged that neither the software involved nor the operator responsible had been identified.
Despite that uncertainty, Napath argued that an attack involving Pegasus-level capabilities would suggest a state-backed operation. He also questioned which foreign government would have an interest in targeting Thailand’s opposition leader. His comments reflected the party’s suspicions rather than forensic findings. No technical evidence has established the source of either attempted intrusion.
Citizen Lab documented Pegasus infections of 30 Thai activists during the 2020–2021 protest movement
Thailand has previously experienced confirmed Pegasus surveillance against political activists. In July 2022, the University of Toronto’s Citizen Lab published an investigation conducted with Thai organisations iLaw and DigitalReach.
Researchers identified at least 30 individuals whose telephones had been infected with Pegasus. The confirmed infections occurred between October 2020 and November 2021.
Those targeted included political activists, academics, lawyers and human rights campaigners. Many were associated with demonstrations demanding political reforms, including changes concerning the monarchy. The investigation followed Apple security notifications sent to Thai activists in November 2021. Subsequently, forensic examinations established that Pegasus had successfully infected several devices.
Among those identified were prominent activists Arnon Nampa, Benja Apan and Panusaya Sithijirawattanakul. Citizen Lab also documented repeated infections of FreeYOUTH activist Jutatip Sirikhan’s telephone. Researchers found evidence that her device had been infected six times. Notably, one intrusion occurred shortly before a major demonstration planned for March 2021.
Amnesty International independently verified five cases examined during the investigation. The findings established that Pegasus had been deployed against individuals involved in Thai political activism. However, researchers could not conclusively identify the government or organisation operating the spyware. The investigation therefore confirmed the surveillance technology without establishing who controlled it.
Past confirmed Pegasus infections contrast with new Apple warnings lacking proof of successful hacking
That distinction remains central to the latest controversy. The earlier infections were established through forensic evidence.
By contrast, the November 2026 incidents currently involve warnings without publicly confirmed successful intrusions. The previous investigation also provides no evidence identifying the operators behind the latest attempted attacks.
Pegasus is developed by Israel’s NSO Group, which markets surveillance technology to government customers. The company maintains that its products are intended for counterterrorism operations and criminal investigations.
Once installed, Pegasus can provide extensive access to information stored on a mobile telephone. Depending on the exploit, operators can obtain messages, photographs, contacts, location records and other private information.
The spyware can also potentially activate microphones and cameras without the owner’s knowledge. Some Pegasus attacks exploit previously unknown software vulnerabilities. Consequently, targets do not necessarily need to open malicious links or download infected attachments. These methods are known as zero-click attacks. They allow intrusions without requiring deliberate action by the telephone owner.
Apple warns of costly mercenary spyware attacks but cannot identify operators behind Thai incidents
Apple distinguishes targeted mercenary spyware operations from conventional malware and ordinary cybercrime. According to the company, such campaigns can cost millions of dollars and require exceptional technical resources.
They have historically been associated with governments and specialist surveillance contractors. Apple issues notifications when it believes individual users have been targeted by sophisticated surveillance operations.
However, the company generally does not identify the specific spyware, country or operator responsible. Furthermore, receiving a warning does not establish that an attempted intrusion succeeded.
This distinction remains critical in the cases involving Abhisit and Nattapong. Abhisit’s preliminary examination found no evidence of successful penetration. No completed forensic assessment confirming infection of Nattapong’s telephone has been publicly disclosed.
Consequently, neither case has been established as a successful Pegasus attack. Nor has any technical investigation publicly linked the warnings to Thai authorities. The government’s earlier procurement requests remain a separate matter, with their dates and outcomes undisclosed.
Chaichanok offers cyber advice as security council prepares to examine spyware warnings and response
On Tuesday, Chaichanok also issued cybersecurity advice to the public. He warned against unsecured public Wi-Fi networks and untrustworthy telephone repair shops. Additionally, he urged users to avoid suspicious advertisements and unfamiliar links.
The minister recommended changing passwords regularly. However, these precautions do not necessarily prevent zero-click attacks exploiting unknown software vulnerabilities.
Chaichanok said the government was consulting technology companies, cybersecurity specialists and countries experienced in combating sophisticated attacks. Officials were also seeking further information from Apple before determining their response. Any additional measures would follow discussions with the National Security Council. The minister did not identify a suspected operator or announce arrests.
Prime Minister in a spot as no confidence debate looks like it’s being stalled or postponed in parliament
Canadian institute identifies Pegasus spyware on phones of 30 people linked to Bangkok protests
As of Tuesday evening, no responsible operator had been identified. Neither politician had publicly confirmed a successful infection, and no criminal charges had been announced. The government had acknowledged earlier Pegasus procurement requests while denying funding allocations during the two latest financial years. The agencies involved, amounts requested and outcomes of those applications remained undisclosed.
Both opposition leaders had received Apple security warnings, while Thailand’s earlier Pegasus infections remained independently documented. The National Security Council was due to examine the controversy on Wednesday, November 4. Its findings and any proposed investigative measures had not yet been announced.
Join the Thai News forum, follow Thai Examiner on Facebook here
Follow Thai Examiner on Google here
Receive all our stories as they come out on Telegram here
Follow Thai Examiner here
Further reading:
Licenced online gambling site abroad linked to the husband of a government MP raises legal quandary
House Committee chair Rome to call Bhumjaithai MP and Australian husband on Wednesday over wealth
Bhumjaithai MP files police report against People’s Party’s Rangsiman Rome over scammer link remarks
Former cabinet minister and Pheu Thai highflyer clarifies Ben Smith and luxury Gulfstream jet story
PM Paetongtarn suspended from duties while Deputy Prime Minister Suriya Jungrungruangkit takes power
