Apple Sends Spyware Threat Alerts to Users in 110 Countries

Apple has sent a fresh wave of threat notifications to users in 110 countries who may have been targeted by mercenary spyware, according to TechCrunch. The alerts were delivered Thursday, alongside an updated Apple support document explaining how recipients should respond. Since launching the program in 2021, the company says it has notified users in more than 150 countries.



Apple describes its threat notifications as high-confidence alerts that a user has been individually targeted by a mercenary spyware attack, likely because of who they are or what they do. These attacks are far more sophisticated than ordinary cybercrime, often costing millions of dollars and targeting a small number of journalists, activists, politicians, diplomats, and other high-profile individuals.


Threat notifications appear on the iPhone Lock Screen and in Settings, alongside email alerts and a banner displayed at the top of the Apple Account page after sign-in. Apple says it updated the experience to make it easier for recipients to quickly access information about what to do next. The notification reads: "Apple detected a mercenary spyware attack targeted at your iPhone. There are actions you can take now to protect your data and device."

Anyone who receives one of these alerts should enable Lockdown Mode and contact the Digital Security Helpline at Access Now for rapid-response emergency security assistance, Apple says. The alerts never ask users to click links, open files, install apps or profiles, or provide an Apple Account password or verification code. Users can verify an alert is genuine by signing in to account.apple.com, where it will appear at the top of the Apple Account page.

Citizen Lab researcher John Scott-Railton, who first highlighted the latest batch of alerts in a thread on X, called the new push notifications a "big improvement" because they do a better job directing recipients to the help they need. According to Apple, it has yet to see a case where someone's device was hacked while Lockdown Mode was enabled.

Although the vast majority of users will never be targeted by mercenary spyware, Apple recommends keeping devices up to date, protecting them with a passcode, Touch ID, or Face ID, enabling two-factor authentication, turning on Stolen Device Protection, installing apps from the App Store, using strong unique passwords and passkeys, and avoiding links or attachments from unknown senders.