Apple has sent a fresh round of Apple threat notifications to users it believes were individually targeted by mercenary spyware. The alerts went out this week, and Citizen Lab senior researcher John Scott-Railton publicized the wave on X. So the company’s long-running warning system is active again.
The notification is serious, but it is not proof of compromise. Apple threat notifications are high-confidence alerts that a user has been individually targeted by a mercenary spyware attack, and should be taken very seriously. Still, an alert means Apple detected activity on a device consistent with such an attack, not necessarily a successful intrusion.
Delivery is hard to miss. The alert appears on the iPhone lock screen, and Apple also sends an email and an iMessage to the account’s contact addresses. So a targeted user sees the warning across the device and the account at once.
What the notification means
Apple’s new support page defines mercenary spyware as sophisticated surveillance tools that companies sell to state actors. Those tools then target specific individuals, often journalists, activists, politicians, and diplomats. Such attacks cost millions of dollars, yet most users will never face one.
Apple also explains why it stays vague about detection. Bad actors could use the details to evade future detection, so the company keeps its methods private. Investigations can never achieve absolute certainty, though Apple has sent notifications multiple times a year since 2021. To date, users in over 150 countries have received them.
What Apple recommends
Recipients get a clear path. Apple advises enabling Lockdown Mode, its extreme protection setting, because the mode blocks most message attachments, FaceTime calls, service invitations, and shared photo albums. The company also points targeted users to expert help, naming Access Now’s Digital Security Helpline for rapid-response assistance.
Meanwhile, Apple repeats basic habits for everyone: keep software updated, and avoid links or attachments from unknown senders.
A familiar threat
Mercenary spyware keeps circling consumer platforms. WhatsApp said the NSO Group is still targeting its users with Pegasus-era tooling. Meanwhile, breaches like the Framework data leak show why device hygiene matters even outside targeted attacks.
