Apple Warns iPhone Users in 110 Countries of Mercenary Spyware Attacks

Apple has issued a new set of high-confidence Apple Threat Notification alerts, warning selected iPhone users in 110 countries that they may be targets of government-grade mercenary spyware.

These notifications are not routine phishing messages or general security advisories. According to Apple, these alerts are sent when internal threat intelligence indicates that a sophisticated and well-funded surveillance operation is likely focusing on a specific individual due to their identity, work, or public role.

Apple Warns iPhone Users

According to CSN, the warning is intentionally noticeable. A red alert may appear on the iPhone lock screen, in Settings under Apple Threat Notification, and on the Apple Account page after signing in.

Additionally, Apple sends emails to addresses associated with the recipient’s Apple ID. This message states that Apple has detected a mercenary spyware attack targeting the user’s iPhone and urges them to take immediate protective action.

For recipients, the alert indicates potential targeting by commercial surveillance tools similar to Pegasus, rather than routine malware campaigns.

These products provide government clients and other powerful entities with ready access to advanced intrusion capabilities, often aimed at journalists, human rights defenders, lawyers, political figures, and civil society organizers.

Researcher John Scott-Railton has emphasized that users should treat an alert as a serious incident-response matter rather than a social media curiosity.

Apple’s first recommendation is to update all Apple devices to the latest available software. It also advises users at risk to consider enabling Lockdown Mode, an optional high-security setting designed to reduce an iPhone’s vulnerability to attacks significantly.

When activated, this feature restricts message attachments, complex web technologies, calls from unknown FaceTime contacts, configuration profiles, and certain wired connections.

The benefits of this enhancement may outweigh the potential drawbacks. Apple reports that it has not observed a successful compromise of any device running Lockdown Mode.

Furthermore, Apple directs affected individuals to Access Now’s 24/7 Digital Security Helpline, which provides free specialist assistance to at-risk civil society users.

This support can connect victims with forensic analysis, personalized risk assessments, and practical mitigation planning. It may also help preserve evidence that could assist investigators and watchdogs examining abuses in the commercial surveillance market.

This is particularly crucial because a public announcement or poorly executed device reset could disrupt evidence or alert an attacker.

For the broader iPhone user base, this incident highlights how sophisticated mobile attacks are increasingly being purchased as services rather than developed in-house.

While most people will never receive one of these notifications, basic security hygiene can still reduce exposure: promptly install iOS updates, use a strong and unique device passcode, review installed configuration profiles, and be cautious with unexpected links or attachments.

However, for those who receive Apple’s alert, the situation constitutes a high-risk, targeted security incident. Following Apple’s guidance, enabling Lockdown Mode, and seeking expert assistance can significantly improve their chances of retaining control over their data and device.

Stop new phishing & malware before they compromise your business. Integrate live intel from 15K SOCs around the world