Mercenary spyware alerts from Apple just went out to users in 110 countries. It is the latest batch of threat notifications the company has issued since the program began in 2021, which now spans more than 150 countries.
The warnings go to individuals whose roles make them appealing targets for commercial spyware operators: journalists, activists, politicians, diplomats, and lawyers. Apple describes the attacks as far more sophisticated than ordinary cybercrime, costing millions of dollars and often having a short shelf life.
Alerts now arrive three ways: a push notification on the iPhone lock screen, an email from Apple, and a warning banner after signing in to an Apple Account. Real notices never request a link click, file opening, profile installation, or a password or verification code, Apple stressed.
The confirmation check is quick: log in at account.apple.com and look for the notice at the top of the page. Apple advises preserving the device, holding off on unnecessary resets until consulting a qualified expert, and reaching out to services such as Access Now’s Digital Security Helpline.
Lockdown Mode remains the strongest available protection, alongside keeping devices updated, enabling two-factor authentication and Stolen Device Protection, and treating unexpected attachments as hostile.
John Scott-Railton of Citizen Lab told TechCrunch the alerts often expose community-wide targeting: recipients seek help, and investigators follow their cases to other victims. Apple does not attribute attacks to specific actors or regions, saying that publishing detection logic would let spyware vendors adapt and evade future detection.
Few users will ever see one of these warnings. Should one appear on your device, treat it as credible until an expert rules otherwise.
