Apple has sent a new round of threat notifications to selected iPhone users in 99 countries, warning that they were targeted by sophisticated mercenary spyware attacks. Security researcher Costin Raiu shared the text of the notice on October 30, 2026, saying the new wave was separate from August's alerts and linked to new attacks.
"Today's notification is being sent to targeted users in 99 countries, and to date we have notified users in over 150 countries in total," the notice reads, as shared by Raiu. Apple did not name the attackers or tie the warnings to any specific region, and it did not immediately respond to a request for comment about the countries involved.
Image: Apple — https://www.apple.com/chfr/iphone/
The figures show where notified users were located, not how many were victims or confirmed infections. Apple's alerts identify targeting with high confidence, but they do not automatically establish that an attacker took control of every notified device.
Costly, targeted operations
Mercenary spyware requires exceptional resources and is aimed at a small number of people. According to Apple, these attacks can cost millions of dollars and often focus on journalists, activists, politicians and diplomats because of their work or public role. Unlike broad phishing campaigns, they are built around specific targets. Apple says their high cost, technical complexity and short lifespan make them hard to detect and prevent. Its investigations rely on internal threat intelligence, and it withholds detection details so attackers cannot learn how to avoid its systems.
Apple has not publicly identified a spyware product, delivery method or software flaw behind this wave. Naming Pegasus or another commercial surveillance tool would go beyond the available evidence; Apple cites Pegasus only as a historical example.
How the alerts arrive and what to do
Apple delivers warnings through iPhone Lock Screen alerts, Settings and emails linked to the user's Apple Account. A banner also appears after signing in to the account. Delivery can vary by device model and software version.
Image: telstra.com.au — https://www.telstra.com.au/apple/phones
Recipients should open Apple's account website on their own and check for the banner. Genuine threat notifications never ask users to install apps or configuration profiles, open files, or share passwords and verification codes. This check helps tell a real warning from a phishing message copying Apple's branding.
Apple recommends Lockdown Mode for people facing these threats. It limits message attachments, some web technologies, incoming FaceTime calls and profile installation. On iPhone it is under Settings, Privacy & Security, then Lockdown Mode. Apple advises updating the device first. Some websites and features may behave differently afterward.
Notified users can also contact Access Now's Digital Security Helpline, which offers round-the-clock expert help. For everyone else, current software, strong account protection and caution with unknown links remain important. Apple says most users will never be targeted by mercenary spyware.
No comments yet. Be the first!