Apple has issued a new round of threat notifications to users in 110 countries, warning them of potential targeting by mercenary spyware. This latest wave of alerts adds to notifications the company has been sending since 2021, which have now reached users in over 150 countries in total.
The alerts are designed to inform individuals who may have been specifically targeted due to their identity or profession. Apple emphasizes that these attacks are far more sophisticated than typical cybercriminal activity, involving significant resources to target a very small number of specific individuals and their devices. The company notes that mercenary spyware attacks can cost millions of dollars and often have a short operational lifespan, making them difficult to detect and prevent.
Recipients of these warnings often include journalists, activists, politicians, diplomats, and lawyers—individuals whose devices may contain sensitive information such as conversations, contacts, documents, or location data. While receiving an alert does not definitively mean a device has been compromised, Apple considers the risk credible based on its observations.
Apple has updated its notification delivery methods. Users may now see a push notification directly on their iPhone lock screen and in Settings, receive an email from `apple@inside.apple.com`, and find a warning banner after signing into their Apple Account. The company stresses that genuine notices will never ask users to click links, open files, install profiles, or provide passwords or verification codes via email or phone.
The company relies exclusively on internal threat intelligence and investigations to detect these attacks. While absolute certainty is not possible, Apple states that its threat notifications are high-confidence alerts and should be taken very seriously. Apple refrains from providing specific details about the causes of these notifications to prevent mercenary spyware attackers from adapting their methods to evade future detection.
If a user receives a warning, Apple advises verifying its authenticity by signing in directly to `account.apple.com`, where a genuine notification will appear at the top of the page. Users are urged to preserve their device, avoid unnecessary resets or changes until consulting with a qualified expert, and seek professional assistance from resources like the Digital Security Helpline run by Access Now.
Apple recommends several security measures, including enabling Lockdown Mode, a high-security setting designed to reduce the attack surface for sophisticated spyware. Other recommendations include keeping devices updated, using a strong passcode with Touch ID or Face ID, enabling two-factor authentication, turning on Stolen Device Protection, using strong and unique passwords or passkeys, installing apps only from the App Store, and treating unexpected links or attachments with caution.
Apple does not attribute these attacks or notifications to specific attackers or geographical regions, highlighting the extreme cost, sophistication, and global nature of mercenary spyware. While most users will never receive such a warning, those who do are advised to treat it as a serious matter until an expert confirms otherwise.
