Apple warns users in 99 countries of mercenary spyware attacks

On Nov. 2, 2026, Apple sent a new round of threat notifications warning users in 99 countries of possible mercenary spyware attacks. Apple declined to identify the attackers behind the alerts and said the warnings are not linked to any specific region. Apple said the current notice reaches targeted users in 99 countries, while total notifications have reached users in more than 150 countries.

Costin Raiu, a threat researcher, reported the new wave on Oct. 30, 2026, saying the wave is separate from August’s alerts and connected to new attacks. Apple said the numbers show where notified users are based rather than how many people were affected or how many devices were compromised.

Apple called the alerts high-confidence warnings that an attacker has singled out a user, while saying they do not prove an attacker took control of every notified device. The company said these operations require exceptional resources, target only a few people, and can cost millions of dollars per attack.

Apple said journalists, activists, politicians and diplomats are the usual targets, chosen because of their public roles or the work they do. The company said these operations are difficult to detect and prevent because of their cost, complexity and short effective lifespan.

Apple said its investigations rely on internal threat intelligence, and it withholds detection details, so attackers cannot learn to evade its systems. The company said it has not publicly named the surveillance tool, infection route, or vulnerability behind this alert wave, and its guidance treats Pegasus as a historical example instead of an attribution for the current attacks.

Apple sends threat warnings through iPhone Lock Screen alerts, the Settings app, and e-mails tied to the user’s Apple Account, and a banner appears once the recipient signs in. Apple said a genuine warning will not ask users to click links, open files, install apps or profiles, or provide passwords and verification codes. To verify a notification, users can sign in at account.apple.com, where a warning Apple sent appears prominently at the top of the page.

Apple characterized the alerts as high-confidence and said recipients should take them seriously, while noting that most iPhone users will never be targeted because the attacks are extremely selective and expensive to run. Apple points notified users to Access Now’s Digital Security Helpline for expert assistance at any hour. Apple recommends Lockdown Mode for people facing mercenary spyware threats, and no threat notification is required to turn it on.

Lockdown Mode arrived with iOS 16 in 2022 as an opt-in configuration that reduces the attack surface spyware developers can use. It restricts incoming message attachments, certain web features, FaceTime calls, and the installation of configuration profiles. On iPhone, it is under Settings, then Privacy & Security, then Lockdown Mode. Apple said users should update their devices before turning on the feature across supported devices, and that some websites and features may behave differently afterward.

Apple said it has observed no mercenary spyware compromise of a device running Lockdown Mode. Donncha Ó Cearbhaill, head of Amnesty International’s Security Lab, said its forensic analysis has not found a Lockdown Mode-enabled device compromised by this class of attack. Lockdown Mode turns off link previews in Messages, blocks wired connections from unrecognized accessories, limits some web browsing technologies, and drops invitation-based features for Apple services including FaceTime and AirDrop. The restrictions aim to remove the attack surface that exploits operate against rather than to block specific known exploits.

Apple recommends that users install the latest iOS version and turn on automatic updates if they have not already done so. Apple advises general users to keep software updated, secure account settings, and avoid unknown links, noting that most will never face spyware threats. Users should secure the account from a separate trusted device by changing the Apple Account password and reviewing each signed-in device. Users should verify trusted phone numbers for multifactor authentication and check for configuration profiles they did not install.

At least two recipients made the notifications public, including Turkey-based reporter Ragıp Soylu and Lebanese filmmaker Radwan Mortada. Ragıp Soylu, Turkey bureau chief for Middle East Eye, said this was the third Apple Threat Notification he has received this year.

Soylu said likely state actors using mercenary spyware had repeatedly attempted to hack his phone. He called the notification a badge of honor and said the hacks are an endorsement for the reporting he does. Radwan Mortada, a Lebanese documentary filmmaker, investigative journalist and author, said on X that he received a Thursday threat notification warning of sophisticated mercenary spyware targeting.

Mortada reports on security issues across the Middle East and has covered the Syrian civil war and Islamic militants for years. In an e-mail to Recorded Future News, he said adversaries had targeted his phone with powerful zero-click Pegasus spyware in 2017 and 2021.

Days after Mortada released an investigative documentary about pager explosions in Lebanon in September 2024, the latest Apple-confirmed attack occurred. Qatar-based Al Jazeera 360 hosts the film. The film concerns attacks that Israel confirmed carrying out against members of the Lebanese Shiite militant group and political party Hezbollah.

After the film’s release, Israeli soldiers entered the family home in southern Lebanon, looted it, and destroyed it with explosives. Mortada acknowledged he has no concrete evidence linking the incident to the latest spyware targeting, though he said the timing and sequence of events raise serious questions. Mortada said what concerns him most is personal safety and privacy, along with the safety of his sources, and that surveillance of investigative journalists threatens source confidentiality. Apple did not respond to a request for comment and had not yet publicized the notifications on its website.

John Scott-Railton of Citizen Lab said the alerts act as a critical signal that attackers target a community, and that recipients who seek help often start investigations revealing many more cases. Scott-Railton cited Poland’s spyware abuse scandal, where the former government used Pegasus against opposition figures, campaign staff, and civil society.

The targeting included Senator Krzysztof Brejza, who was reportedly targeted dozens of times in 2019. Polish authorities arrested former spy chief Piotr Pogonowski in December 2024 to compel his testimony to parliament. Scott-Railton said Poland’s investigation has implicated the former government in targeting as many as 600 people.

John Scott-Railton, a digital forensic researcher at Citizen Lab, said Apple Threat Notifications drive accountability. He said the August changes making notifications more visible seem to be working based on targets coming forward publicly.

Scott-Railton warned people to be wary of firms selling paid fixes for spyware infections and said a missing notification does not rule out infection. He seconded Apple’s recommended steps of enabling Lockdown Mode and getting in touch with Access Now. Natalia Krapiva, senior tech-legal counsel with Access Now, said adopting states must agree the current system fails and that the spyware industry should face real consequences for uncontrolled tool sales and for declining to curb abuses. The notifications often lead victims to approach Access Now, Citizen Lab and other groups seeking further help and prompting deeper investigations.

The notifications preceded the final rounds of talks on voluntary industry standards for commercial hacking tools under the Pall Mall Process, which follows earlier government-focused guidelines. Mercenary spyware stays invisible by design, and attackers pick targets based on who they are and what they know.

NSO Group’s Pegasus is the flagship iPhone spyware in this category and the best-documented example. Apple launched its threat notification system in late 2021. Earlier, warnings went out by e-mail from threat-notifications@email.apple.com, by iMessage, and as a banner after a user logged into their Apple Account.

The August wave covered 110 countries, the largest single wave in the program’s history, and marked the first time in five years that warnings arrived directly on the Lock Screen. Apple declines to name the spyware type in alerts or explain its detection methods, citing concern that disclosure could help attackers evade detection.

Citizen Lab documented Paragon Solutions’ Graphite spyware targeting civil society members in Italy, including journalists and humanitarian workers, in an investigation from March 2025. Intellexa’s Predator has been linked to targeting in the United States and many EU member states.

In the WhatsApp case, a federal court found NSO Group responsible for violating anti-hacking laws, and the jury awarded approximately $167 million in damages in May 2025. A permanent injunction entered into force on Jan. 28, 2026. Meta filed a contempt motion in June 2026 alleging that NSO began new spyware campaigns against WhatsApp users shortly after the injunction took effect.

Jamf’s Adam Boynton said mercenary spyware economics have placed executives, negotiators, and people with privileged access on a growing target list. Boynton said recipients must treat any such alert on a work device as a security incident right away. Boynton said attackers rely on zero-day exploits because iPhone defenses offer no cheaper way in. A compromise exposes every conversation on the device, meaning sources, colleagues, and relatives who never received an alert may have had their messages read by an operator.