Apple's spyware alerts reached 110 countries, and they land on people, not fleets
Apple's latest mercenary spyware notifications went to users in 110 countries. The response checklist is per-person, and a standard MDM baseline covers almost none of it.
The Watch · Security desk
What happened
- Apple began sending a new wave of mercenary spyware threat notifications to iPhone users, with the alerts sent on August 13; Apple has issued such alerts since 2021 when it detects highly targeted attacks.
- Apple told TechCrunch that the latest round of threat notifications reached people in 110 countries.
- Apple states that its threat notifications are designed to inform and assist users who may have been individually targeted by mercenary spyware attacks, likely because of who they are or what they do.
- Apple says that since 2021 it has sent threat notifications multiple times a year and has to date notified users in over 150 countries in total.
- The 110 countries in the latest wave equal about 73 percent of the more than 150 countries Apple has notified cumulatively since 2021.
Why it matters
Apple pushed another round of mercenary spyware threat notifications on 13 August, and told TechCrunch the alerts reached people in 110 countries [1][2]. The number is not the operational point. The point is the targeting model: Apple says these notifications go to users it believes were individually singled out, likely because of who they are or what they do [3].
Apple has notified users in more than 150 countries since the programme started in 2021 [4], so the latest wave alone touches roughly three quarters of the cumulative country count [21]. Apple describes the attacks as costing millions of dollars with a short shelf life, which makes them harder to detect and prevent [6], and says the vast majority of users will never be targeted [7]. The people who do get notified tend to be journalists, activists, politicians, diplomats and lawyers [8]. Per SC Media's summary of Bleeping Computer's reporting, Apple points to NSO Group's Pegasus as a historical example [9]; Malwarebytes describes the category as commercial surveillance vendors selling to government customers [10]. Apple itself attributes nothing to any attacker or region [11].
Sort the recommended response into two piles and the staffing problem becomes visible. The first pile is what a fleet policy already enforces: current software, a passcode with Touch ID or Face ID, two-factor authentication, Stolen Device Protection, App Store-only installs, strong unique passwords or passkeys, and suspicion of unexpected links [17]. If that is your whole answer, you have answered a different question.
The second pile is individual and mostly manual. Lockdown Mode has to be turned on, and Apple recommends it for recipients [12]. The notification has to be verified by signing in directly at account.apple.com, where a genuine alert appears at the top of the page [5]. The device has to be preserved, with resets and changes avoided until someone qualified has looked at it [14]. Outside help is expected: Apple points recipients to the Access Now Digital Security Helpline [15]. None of that is a configuration profile.
The delivery path compounds it. The alert now appears on the iPhone Lock Screen and in Settings, by email from threat-notifications@apple.com, and as a banner in the user's Apple Account [16]. Every one of those channels terminates with the individual, on a personal account, which means a security team learns about it only if the person knows to escalate. Apple also declines to explain what triggered a notification, on the grounds that publishing detection logic would help vendors evade it [18], and says it relies solely on internal threat intelligence, cannot achieve absolute certainty, but treats the alerts as high confidence [19]. There is no indicator to sweep the fleet for. Security Affairs notes that a notification does not mean the recipient was fully compromised, only that Apple saw enough to treat the risk as credible [20].
Two reasons this is not purely someone else's problem. Citizen Lab's John Scott-Railton told TechCrunch that notifications can reveal that an entire community is being targeted [22], so one alert in a team is a question about the team. And Malwarebytes argues that techniques built for narrow operations spread, through reuse, onward sale, reverse engineering, copying by other vendors, and adaptation by criminal groups [23].
What to watch: whether anyone at your organisation has actually received one of these and told nobody; whether Lockdown Mode is tested against the workflows of your highest-exposure roles before it is needed; and who pays for forensics on a personal device when the answer cannot wait.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence60
- Adoption
- Not scored
- Hype gap+10
- Incentives40
- Confidence65
Perspective Coverage
4 publishers- Builder
- Builder 16%
- Operator
- Operator 79%
- Investor
- Investor 5%
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
Apple began sending a new wave of mercenary spyware threat notifications to iPhone users, with the alerts sent on August 13; Apple has issued such alerts since 2021 when it detects highly targeted attacks.
- [2]
Apple told TechCrunch that the latest round of threat notifications reached people in 110 countries.
- [3]
Apple states that its threat notifications are designed to inform and assist users who may have been individually targeted by mercenary spyware attacks, likely because of who they are or what they do.
- [4]
Apple says that since 2021 it has sent threat notifications multiple times a year and has to date notified users in over 150 countries in total.
- [5]
A recipient can verify a notification by signing in directly at account.apple.com, where a genuine Apple threat notification appears at the top of the page.
- [6]
Apple says mercenary spyware attacks cost millions of dollars and often have a short shelf life, making them much harder to detect and prevent.
- [7]
Apple says the vast majority of users will never be targeted by mercenary spyware attacks, which apply exceptional resources against a very small number of specific individuals and their devices.
- [8]
The people most likely to receive these notifications include journalists, activists, politicians, diplomats, lawyers, and others whose devices may hold valuable conversations, contacts, documents or location data.
- [9]
Apple does not identify the specific spyware or attackers, but cites NSO Group's Pegasus as an example historically associated with such attacks.
- [10]
Malwarebytes describes mercenary spyware attacks as highly sophisticated campaigns usually associated with commercial surveillance vendors and their government customers.
- [11]
Apple says it does not attribute the attacks or resulting threat notifications to any specific attackers or geographical regions.
- [12]
Apple recommends enabling Lockdown Mode, its high-security setting designed to reduce the attack surface available to sophisticated spyware.
- [13]
Malwarebytes warns that scammers will attempt to mimic Apple threat notifications, and that genuine notices will never ask users to click a link, open a file, install a profile, or provide a password or verification code by email or phone.
- [14]
Recipients are advised to preserve the device and avoid unnecessary resets or changes until they have spoken to someone qualified.
- [15]
If a user receives an Apple threat notification, Apple recommends seeking expert help, such as the Digital Security Helpline run by Access Now.
- [16]
Apple now delivers the alert as a push notification on the iPhone Lock Screen and in Settings, as an email from threat-notifications@apple.com, and as a warning banner after signing in to the user's Apple Account.
- [17]
Apple advises users to keep devices updated, protect them with a passcode plus Touch ID or Face ID, use two-factor authentication and a strong Apple Account password, turn on Stolen Device Protection, install apps only from the App Store, use strong and unique passwords or passkeys, and avoid links or attachments from unknown senders.
- [18]
Apple says it is unable to provide information about what causes it to issue threat notifications, as that may help mercenary spyware attackers adapt their behaviour to evade detection in future.
- [19]
Apple says it relies solely on internal threat-intelligence information and investigations to detect such attacks, that its investigations can never achieve absolute certainty, and that the notifications are high-confidence alerts that should be taken very seriously.
- [20]
Receiving a notification does not mean every recipient has been fully compromised, but it does mean Apple has observed enough to treat the risk as credible.
- [21]
The 110 countries in the latest wave equal about 73 percent of the more than 150 countries Apple has notified cumulatively since 2021.
- [22]
Citizen Lab researcher John Scott-Railton told TechCrunch that notifications can reveal that an entire community is being targeted.
- [23]
Malwarebytes argues that attack techniques developed for narrowly targeted operations spread, as exploits can be reused, sold onward, reverse engineered, copied by other surveillance vendors, or adapted by criminal groups.
Sources
4 independent publishers whose own reporting we read for this story.
- bleepingcomputer.comApple sends new ‘Threat Notification’ alerts over mercenary spyware attacks
1 article · August 13, 2026
- malwarebytes.comApple now uses iPhone alerts for targets of mercenary spyware
1 article · August 14, 2026
- scworld.comApple warns users of mercenary spyware attacks on iPhones
1 article · August 14, 2026
- securityaffairs.comApple warned hundreds of users of mercenary spyware attacks
1 article · August 14, 2026