Apple has issued a new wave of high-confidence Threat Notifications to selected iPhone users in 110 countries, warning that their devices may have been individually targeted by mercenary spyware.
The notifications signal suspected activity associated with exceptionally capable, well-funded surveillance operations, not routine phishing, commodity malware, or broad criminal campaigns.
Apple says threat notifications are intended for people believed to be targeted because of “who they are or what they do.”
Apple Sends Spyware Attack Alerts
The company characterizes mercenary spyware operations as vastly more complex than typical cybercrime: attackers dedicate exceptional resources to a very small pool of victims, exploits can be expensive and short-lived, and the activity evolves quickly to evade detection.
Public research has historically linked such attacks to state actors and private surveillance vendors. Pegasus, developed by NSO Group, is one prominent example cited by Apple, although the company does not attribute individual notifications to a particular spyware family, customer, government, or country.
Apple has issued these alerts multiple times each year since 2021 and says it has notified users in more than 150 countries overall. Likely targets include journalists, activists, politicians, diplomats, lawyers, and civil-society figures.
An alert does not by itself prove that an iPhone has been successfully compromised; it indicates that Apple’s threat intelligence has detected activity consistent with an attempt to target the user.
Apple describes the alerts as high-confidence, while acknowledging that absolute certainty is not possible.
The latest rollout makes the warning more visible. Recipients can now see a push notification directly on an iPhone’s lock screen, along with an alert in Settings and a prominent banner after signing in to account.apple.com.
Apple also sends notifications through email and iMessage to addresses and phone numbers linked to the user’s Apple Account. The notification states: “Apple detected a mercenary spyware attack targeted at your iPhone.
There are actions you can take now to help protect your data and device.” This direct language is important: victims should treat it as a security incident requiring prompt containment and expert assessment, not as a generic warning to ignore or share publicly.
Apple also cautions that authentic threat notifications will never instruct users to click a link, install an application or configuration profile, open a file, or disclose an Apple Account password or verification code.
Users should validate the warning by manually navigating to account.apple.com and checking for the threat banner after authentication. Apple advises affected users to update every Apple device to the latest available software and enable Lockdown Mode.
The optional protection, available on supported iPhone, iPad, Mac, and Apple Watch software releases, sharply reduces exposed functionality, constraining exploit paths commonly used in targeted spyware operations.
For example, Lockdown Mode blocks most message attachment types, limits complex web technologies, blocks unsolicited FaceTime calls, prevents the installation of configuration profiles, and requires an iPhone or iPad to be unlocked before connecting wired accessories.
CSN stated that it disables automatic connection to non-secure Wi-Fi networks and turns off 2G and 3G support on iPhone and iPad.
The trade-off is deliberate: websites, collaboration features, Apple-service invitations, and some messaging workflows may function differently or not at all. For users facing a credible mercenary spyware threat, that reduced convenience is preferable to an expanded attack surface.
Apple recommends that recipients seek rapid specialist help through Access Now’s 24/7 Digital Security Helpline, which can provide tailored advice and coordinate a risk-focused response.
External organizations cannot see the detection signals that caused Apple to issue the alert, but they can assist with device-handling decisions and security hardening.
For most iPhone owners, the risk remains low. Still, the campaign reinforces core mobile-security practices: promptly apply iOS updates, use a strong passcode and two-factor authentication, install apps only from the App Store, and avoid unexpected links or attachments.
Detect, investigate, and respond faster with in-browser data inspection from ANY.RUN. Gain complete phishing visibility to strengthen your SOC and reduce MTTR
