Apple on Thursday sent a fresh wave of threat notifications to customers in 110 countries, warning that they may have been targeted by mercenary spyware capable of compromising their iPhones, iPads, or Macs. The company told TechCrunch that the alerts went out to users across those countries, and that it has now notified customers in more than 150 countries since it first introduced the alerts in 2021.
The notification, which appears directly on the iPhone lock screen, reads: “Apple detected a mercenary spyware attack targeted at your iPhone. There are actions you can take now to protect your data and device.” Apple says it has updated the user experience to make it easier for recipients to access clear guidance on next steps. Alerts are also sent by email and when users sign in to their Apple ID account.
Also read: Twitch will train Amazon's AI on streamers' content by default — here's how to opt out
What the notifications mean — and why they matter
John Scott-Railton, a senior researcher at Citizen Lab, first flagged the latest batch of notifications in a thread on X. He described the new push notifications as a “big improvement” in urging people to seek help, noting that they create a critical signal that a community is being targeted. “People get an alert, and then some of them reach out and seek help. Often this kicks off an investigation that reveals many, many more cases,” he told TechCrunch.
Scott-Railton pointed to the ongoing scandal in Poland over the former government’s use of spyware against its rivals as an example of the impact these alerts can have. “Without Apple’s notifications, that entire massive scandal about spyware abuse in the Polish election wouldn’t have been uncovered,” he said.
Also read: Northrop Grumman's robotic space mechanic undocks from satellite, preps for next-gen servicing
Receiving a threat notification does not necessarily mean your device has been successfully hacked. It indicates that Apple’s systems have detected activity consistent with a targeted spyware attack, which is often linked to government or state-sponsored actors. The attacks are generally rare, but their proliferation in recent years has made them a serious concern for journalists, activists, and members of civil society.
What to do if you get an alert
If you receive a notification, Apple advises taking immediate steps to protect your device and data. The alert itself opens up advice on who to contact for help, and it strongly recommends switching on Lockdown Mode — a security feature that significantly reduces the attack surface available to spyware. Apple says it has yet to see a case where a device was hacked while Lockdown Mode was enabled.
Beyond enabling Lockdown Mode, users should also consider updating to the latest software, reviewing their Apple ID security settings, and being cautious about clicking links or opening attachments from unknown sources. For high-risk individuals, additional steps may include using a dedicated device for sensitive communications and seeking help from digital security organizations like Citizen Lab.
The latest round of notifications underscores how widespread government-grade spyware has become. Apple’s alerts, first introduced in 2021, have evolved into a critical early-warning system for people who might otherwise never know they were targeted. As Scott-Railton’s comments suggest, these notifications do more than protect individual devices — they can expose broader patterns of abuse that might otherwise remain hidden.
For now, the key takeaway for users is simple: if you get a notification from Apple about a spyware attack, don’t ignore it. Even if the attack wasn’t successful, the alert is a signal that you may be at elevated risk, and taking protective action now could prevent a serious compromise later.
This article is for informational purposes only and does not constitute legal or financial advice. Cybersecurity threats evolve rapidly, and readers should consult official sources and security experts for guidance tailored to their situation.
