Apple Sounds Mercenary Spyware Alarm For Millions Of iPhone Users

by Aaron Leong — Monday, August 17, 2026, 10:53 AM EDT

Apple Threat Detection notification - Image: Apple

Apple has issued high-confidence threat notifications to targeted users across 110 countries, warning that their devices may have been targeted by sophisticated mercenary spyware attacks.

The global alert is Cupertino's latest push to counter state-sponsored surveillance operations that compromise personal devices. According to the company, these mercenary spyware attacks are vastly more complex than standard cybercrime or consumer malware. They cost millions of dollars to develop and deploy, targeting a very small, highly specific subset of individuals, typically journalists, political dissidents, human rights activists, and diplomats (obviously because of "who they are or what they do").

To ensure recipients take notice and take immediate action before falling victim to these phishing attempts, Apple is delivering warnings through three specific channels. First, an official Apple Threat Notification alert appears on the user's iPhone Lock Screen and within the main Settings menu. Second, an email is dispatched from `threat-notifications@email.apple.com` to any address associated with the target's Apple account. Finally, a prominent banner displays at the top of the screen whenever the user signs into `account.apple.com`. Take note that legitimate Apple threat notifications will never ask users to click external links, open email attachments, download third-party profiles, or reveal their Apple Account passwords or verification codes.

Two examples of iOS threat notifications - Image: Apple

Because mercenary spyware developers constantly seek ways to evade detection, Apple intentionally refrains from attributing the attacks to specific threat actors or geographic regions. The company also keeps the underlying detection mechanisms secret to prevent attackers from adapting their tactics. Still, Apple emphasized that its internal threat intelligence investigations yield high-confidence results, meaning any user who receives an alert should totally treat it with extreme urgency.

Therefore, for those who do receive a notification, Apple strongly recommends immediately enabling Lockdown Mode on their devices. Built directly into iOS, iPadOS, and macOS, Lockdown Mode aggressively restricts device and OS functionality, blocking most message attachment types, complex web browsing features, and incoming FaceTime calls from unknown numbers. Apple also suggests that targeted individuals obtain emergency technical assistance from specialized civil society organizations, such as the nonprofit Access Now's Digital Security Helpline, which offers 24/7 incident response support.

Even if most consumers will never face mercenary spyware campaigns like the one Apple is warning about, it is still good practice to maintain basic security hygiene by keeping device software updated, enforcing strong passcodes, and enabling two-factor authentication.