Apple Issues Spyware Attack Alerts to Users in 110 Countries

Apple has dispatched a new wave of security notifications to users across 110 countries, warning that they may have been individually targeted by mercenary spyware capable of compromising their iPhones, iPads, or Macs. The alerts, sent on Thursday, mark the latest escalation in the company's ongoing effort to counter sophisticated digital surveillance tools that security researchers say are often deployed by nation-states against journalists, activists, and political figures.

The Cupertino-based technology giant confirmed the scope of the latest round to TechCrunch, noting that it has now alerted customers in more than 150 countries since it began issuing such warnings in 2021. The notifications appear directly on a user's lock screen with a message reading: "Apple detected a mercenary spyware attack targeted at your iPhone. There are actions you can take now to protect your data and device."

Apple has also updated how recipients access information the alerts. According to a newly published support document titled " Apple threat notifications and protecting against mercenary spyware," the warnings can now appear immediately after users sign in to their Apple Account, in addition to being delivered via email and iMessage. The company said it has refined the user experience to make it easier for recipients to find guidance on what to do .

The company characterizes mercenary spyware attacks as fundamentally different from ordinary cybercrime. These operations are highly sophisticated, backed by substantial financial resources, and directed at a small number of specific individuals rather than mass targets. Apple says the attacks tend to be short in duration, making them extremely difficult to detect and prevent. Public reporting and research from civil society organizations, technology companies, and journalists have historically linked such costly, precision-targeted operations to state actors.

Apple relies exclusively on internal threat intelligence and investigations to identify potential victims. The company acknowledged that its findings are not absolutely certain but emphasized that the notifications represent high-confidence warnings that should be treated with the utmost seriousness. Apple declined to disclose the specific evidence behind individual alerts, explaining that revealing such information could allow spyware operators to alter their tactics and evade future detection. The company also said it does not attribute the attacks to particular actors or regions.

Recommended Security Measures

Apple's support guidance urges anyone who receives a threat notification to seek expert assistance and enable Lockdown Mode, a security feature that dramatically reduces the attack surface of Apple devices. According to Apple, the company has yet to see a case where a device was successfully hacked while Lockdown Mode was active. The guidance also recommends several baseline security practices:

Note: Recommendations apply to all users, though Apple notes that most people will never be targeted by mercenary spyware.

Apple directs recipients to Access Now's Digital Security Helpline, a nonprofit rapid-response service that provides tailored security advice to people who believe they have been targeted. The helpline operates 24 hours a day, seven days a week, and can be reached through its website. Apple cautioned that outside organizations do not have information why a specific notification was sent, but they can assist targeted users with personalized security guidance.

A Signal for Broader Investigations

John Scott-Railton, a senior researcher at the University of Toronto's Citizen Lab, first drew public attention to the latest batch of notifications in a post on X. He urged recipients to seek expert security help immediately, noting that the alerts indicate technology such as Pegasus may have been used to spy on them.

Scott-Railton told TechCrunch that the notifications represent a "big improvement" in prompting people to secure their devices since Apple debuted its spyware alerts. "Notifications create a critical signal that a community is being targeted," he said. "People get an alert, and then some of them reach out and seek help. Often this kicks off an investigation that reveals many, many more cases."

He pointed to the ongoing scandal in Poland over the former government's use of spyware against political opponents as an example of the alerts' broader impact. Without Apple's notifications, Scott-Railton said, "that entire massive scandal spyware abuse in the Polish election wouldn't have been uncovered."

Apple first introduced threat notifications in 2021 and has since distributed them several times per year as new attacks are detected. A little more than a year ago, the company sent warnings to users in 100 countries. It later confirmed that it had alerted more than a dozen Iranian cyberattack victims in the period leading up to the conflict with Israel.

The company emphasized that receiving a notification does not necessarily mean a device was successfully compromised. Rather, it indicates that Apple believes the user may have been targeted and should take immediate protective action. The distinction matters because spyware operators frequently attempt attacks that fail but still leave traces that Apple's detection systems can identify.

Once added, BigGo Finance appears first in Google Top Stories, so you get the broadest, most up-to-the-minute, and most comprehensive global financial news first.