Threat intel
Apple warns spyware targets in 99 countries
A new wave of Apple threat notifications hit users in 99 countries from October 29. How to tell a real alert, and what recipients and employers should do.
From Thursday, October 29, Apple began sending a new round of threat notifications to people it believes were individually targeted with mercenary spyware. The notice says it is going to targeted users in 99 countries, and that Apple has now notified users in more than 150 countries since it started in 2021. The text became public on October 30, when threat researcher Costin Raiu posted it, and CyberScoop and The Next Web reported the same figures. Techaeris dates the send to the morning of October 30, but German recipients and at least one journalist reported getting it on October 29. Apple has not made a public statement and has not said how many people received it.
Recipients named so far include journalists and documentary makers, and several members of the German Bundestag and other officials. Germany's Federal Office for Information Security (BSI) told affected lawmakers to treat their iPhones as possibly compromised. If anyone in your organization travels, negotiates, reports, litigates or holds public office, this wave is worth ten minutes of your security team's time today.
How Apple's threat notifications work
Mercenary spyware is commercial surveillance software, sold by private companies and usually bought by governments, that is installed on a chosen person's phone to read messages (including encrypted chats), and to switch on the camera and microphone. Apple's notice describes these attacks as extremely costly, sophisticated and worldwide.
When Apple's threat intelligence work gives it high confidence that a specific Apple Account was targeted, it notifies the owner. Since the August 13 wave, which reached users in 110 countries, the alert can appear on the iPhone itself, on the Lock Screen and in Settings. Apple also emails the addresses tied to the Apple Account, with Apple Threat Notifications as the sender, and shows a banner at the top of the account page when the user signs in at account.apple.com.
A notification means Apple believes the person was targeted. It does not confirm the phone was infected, and Apple never says what evidence triggered it. Raiu said this round is separate from the August one and tied to new attacks, so people who already handled an August alert should treat a new one as a new incident.
What attackers are doing
Almost none of the technical side is public. Apple's policy is that it does "not attribute the attacks or resulting threat notifications to any specific attackers or geographical regions", and it has named no spyware product, vendor or vulnerability for this wave. It also does not publish the list of countries, only the count.
The people who have spoken publicly fit the usual profile. Radwan Mortada, a Lebanese investigative journalist who was previously targeted with NSO Group's Pegasus in 2017 and 2021, said on X that he had received the alert. In Germany, government spokesperson Stefan Kornelius said the government is taking the incident "very seriously", but would not say which members of the government were affected.
For businesses, Apple's earlier waves set the pattern: a small number of chosen people, with no sign of mass exploitation. The people at risk are the ones whose phones hold something a government would pay for. Think executives in sensitive deals, lawyers, staff in regulated or state-adjacent sectors, and anyone who deals with journalists or activists. How the spyware reaches a phone varies; our post on AdFection covers one recent case where it was pushed through online ads with no click.
What to do
Check that the alert is real
Fake threat notifications exist, and they are a ready-made phishing lure for exactly the people who would get a real one. Do not use any link or attachment in the email. Type account.apple.com into the browser and sign in: a genuine notification shows as a banner at the top of the page. Apple says its notices never ask you to click a link, open a file, install an app or profile, or give your Apple Account password or a verification code, by email or by phone. A message that asks for any of those is not from Apple.
If you are the recipient
- Contact Access Now's Digital Security Helpline, which Apple points recipients to. Apple describes it as rapid-response emergency help, available 24 hours a day.
- Do not factory reset or wipe the phone first. A reset destroys the traces an examiner needs and does not tell you whether you were hit. Make an encrypted local backup on a computer you trust, which is the format Amnesty International's Mobile Verification Toolkit (MVT) analyses.
- Install the latest iOS (Settings, General, Software Update) and restart. Apple's guidance says the latest software carries the latest security fixes.
- Turn on Lockdown Mode (Settings, Privacy & Security, Lockdown Mode) and keep it on. Apple says it is not aware of anyone using Lockdown Mode being successfully attacked with mercenary spyware. It makes new attacks harder; it does not remove an infection that is already there.
- Until the phone is checked, keep sensitive conversations off it.
If you are the employer
Ask high-risk staff to report any threat notification to the security team straight away, and open an incident when one comes in. Then work through the person's access:
- Revoke their sign-in sessions. In Microsoft Entra ID that is Revoke sessions on the user in the admin center, or
Revoke-MgUserSignInSessionin Microsoft Graph PowerShell; in Google Workspace, reset the user's sign-in cookies from their page in the Admin console. Do the same for any SaaS app that held a session on the phone. - Review their MFA methods and remove any device or phone number you cannot account for.
- Check their mailbox for new inbox rules, forwarding and app consents added recently.
- In account.apple.com, check the list of devices signed in to their Apple Account and remove any they do not recognise.
- Mark the phone as untrusted in your mobile device management (MDM) tool until the check is done, so it cannot reach work data.
Lockdown Mode is the user's choice, and a device in Lockdown Mode cannot be newly enrolled in MDM, so enrol first. The version rules and enforcement steps we covered for the CoreGraphics zero-day apply here too.
The lesson for security teams
These notices go to the person, and Apple tells the employer nothing. Unless staff know to forward them, the security team learns about a targeted attack on an executive's phone from the news, if at all. Put Apple threat notifications, and the similar warnings Google sends about government-backed attacks, into your incident reporting guidance, name the people who are most likely to receive one, and agree in advance who they call and what happens to the phone.
Our safeguarding and hardening work sets up the session, MFA and MDM controls that let you contain a targeted phone quickly, and our security operations team handles the incident when a notice comes in. Open the chat and Yaali, our AI agent, will pass your question to the engineer who would do the work.
Sources: CyberScoop, The Next Web, 9to5Mac, Techaeris, Apple, About Apple threat notifications and protecting against mercenary spyware, Apple, About Lockdown Mode, 9to5Mac on the August 2026 wave, Malwarebytes on the August 2026 wave, Access Now Digital Security Helpline, Amnesty International Mobile Verification Toolkit.