Apple sent high-confidence threat notifications to iPhone users across 99 countries, warning that they may have been targeted by mercenary spyware. Receiving one of those alerts is serious. It does not confirm that spyware successfully infected a device. That distinction matters. Apple’s system flags activity consistent with a targeting attempt; it cannot always confirm a completed compromise.
The 99-country figure describes the geographic spread of a notification batch, not a confirmed victim count.
How the Timeline Developed
Two separate notification waves are at the center of this story, and the figures attached to each are not interchangeable.
Cybersecurity researcher Costin Raiu reported a new wave of activity on October 30, noting it was separate from Apple’s earlier notification round sent in August. Raiu’s reporting referenced users in 99 countries, including journalists and documentary filmmakers.
Apple had previously confirmed a broader figure of 110 countries for the August notification round. Those two figures describe distinct batches and should not be conflated.
No attacker has been identified. Raiu said available logs contained no evidence pointing to a responsible actor, and no spyware vendor or government has been linked to either wave.
Why Mercenary Spyware Is a Different Category of Threat
Apple describes these attacks as among the most advanced and expensive digital threats in existence, far removed from ordinary phishing.
Apple says mercenary-spyware campaigns are exceptionally costly and technically sophisticated. They are distinct from the broad criminal phishing operations most users encounter, unlike cases of secretly tracking users through commercial apps.
Some attacks of this type exploit vulnerabilities without requiring the target to click a link or open a file. The available reporting does not establish that such an exploit was used in the October wave.
How Apple’s Notification System Works
Four separate channels carry Apple’s threat alerts, and the program has been running globally since 2021.
Alerts can appear on the iPhone Lock Screen, inside Settings, by email to the address linked to an Apple Account, and on the Apple Account webpage. Apple has sent these notifications to users in more than 150 countries since launching the program in 2021.
Apple withholds technical details about its detection methods. The company says disclosure would help attackers design around future defenses.
What Recipients Should Do
Verification, software updates, and Lockdown Mode are the three steps Apple emphasizes for anyone who receives a threat notification.
Anyone who received a notification should verify it by signing in directly to the Apple Account page rather than clicking any link inside an email or message. Apple’s genuine threat notifications never ask users to open files, install apps or configuration profiles, or provide passwords or verification codes.
Update every Apple device to the latest available software. Then enable Lockdown Mode: go to Settings, then Privacy and Security, then Lockdown Mode.
Lockdown Mode must be activated separately on each device, including iPad and Mac. It reduces the available attack surface for sophisticated exploits, but it is not forensic evidence that a device was or was not compromised. Recipients who need that determination should contact Apple or a qualified security organization to stay safe.
