Apple has begun notifying iPhone users in 99 countries about a fresh wave of threats from sophisticated mercenary spyware activity. This alert distribution, announced October 30, 2026, represents a new phase separate from similar warnings issued in August. To date, users in more than 150 countries have now received such notifications.
What Apple is warning users about
The company’s recent messaging targets individuals it believes have been specifically targeted with high-confidence spyware attacks driven by mercenary operators. These campaigns are not widespread phishing or opportunistic hacking but highly tailored operations often directed at journalists, activists, politicians, and diplomats. The tools and methods behind this new set of alerts remain unconfirmed, and no particular spyware product, software vulnerability, or exploit has been publicly tied to the incident.
How alerts look & what to do
Notifications arrive through multiple channels: via the iPhone lock screen, through Settings, and via email tied to the user’s Apple account. After signing in, users may also see banner alerts. Apple emphasizes that legitimate warnings will never ask people to install apps or configuration profiles, open files, or share passwords or verification codes—signs that often indicate phishing or scam attempts.
For those receiving these alerts, Apple urges immediate action. First, update all devices to the latest software. Then, switch on Lockdown Mode, a security setting that limits message attachments, certain web technologies, configuration profile installations, and some FaceTime call capabilities. These restrictions help close off attack vectors commonly used by sophisticated spyware tools.
Apple also directs users to Access Now’s Digital Security Helpline for expert assistance and reinforces that even outside of these alerts, strong security practices—using current software, being wary of unfamiliar links, securing accounts with strong credentials and two-factor protection—matter for everyone. The company notes that most users will most likely never be the targets of such high-end surveillance threats, but when they are, they must take them seriously.
The earlier August alerts covered 110 countries; these recent warnings mark a separate and distinct wave. It’s important to understand that the number of countries affected reflects where users got notifications—not a confirmed count of victims or compromised devices. Even when targeting is certain, Apple clarifies, it does not mean each notified device was successfully compromised.
Apple’s guidance underscores the difficulty in detecting, preventing, or attributing mercenary spyware attacks. Because the operations tend to be resource-intensive, technically sophisticated, and short-lived, the threat landscape can be opaque. Public attribution—such as assigning blame to Pegasus or any other known commercial spyware—is not provided for this wave, though past tools like Pegasus are discussed in historical context.
What to watch next: whether Apple provides technical details about how these attacks are delivered or if any specific spyware vendor becomes linked. Also, for users at higher risk—journalists, diplomats, activists—the effectiveness and usability of Lockdown Mode in everyday scenarios will remain under scrutiny.
