Apple warns about highly sophisticated “mercenary spyware” attacks, with new lock-screen notifications making threat alerts easier to access
Apple has issued a fresh wave of threat notifications to users in 110 countries, warning that their iPhones, iPads or Macs may have been targeted by highly sophisticated “mercenary spyware”. The company says these attacks are exceptionally advanced and are typically directed at a very small number of specific individuals because of who they are or what they do.
The latest notifications were sent on August 13, according to the information provided, and represent another stage in Apple’s continuing effort to alert customers who may be individually targeted by sophisticated surveillance software.
Apple says mercenary spyware attacks are fundamentally different from ordinary cybercrime and consumer malware. They can involve substantial resources, advanced capabilities and highly targeted operations aimed at specific devices. Apple’s official guidance describes such attacks as exceptionally complex and notes that they have historically targeted journalists, activists, politicians and diplomats.
The company has also updated the way it communicates these warnings. Threat notifications can now be surfaced directly through push notifications on a device’s lock screen, alongside other notification methods. The aim is to make it easier for affected users to find information about the threat and review the security measures recommended by Apple.
Table of Contents
Apple Expands Warnings Against Mercenary Spyware
Apple has been issuing specialised threat notifications since 2021.
According to the company, it has now notified users in more than 150 countries in total about suspected mercenary spyware attacks. Apple says the warnings are based on internal threat intelligence and investigations and are intended for users who appear to have been individually targeted.
The latest campaign involving users in 110 countries therefore forms part of a wider global effort by Apple to monitor and communicate sophisticated attacks.
Unlike broad consumer malware campaigns, mercenary spyware operations are generally designed around specific targets. Apple says attackers may devote significant resources to compromising a limited number of individuals, making such attacks considerably more difficult to detect and defend against than conventional cyber threats.
That targeted nature also explains why Apple does not treat these warnings as routine security notifications.
What Is Mercenary Spyware?
Mercenary spyware refers to highly sophisticated surveillance software developed or sold by private companies and used in targeted operations.
These tools can be extremely expensive and may be designed to exploit security weaknesses in mobile devices and computers. Apple says such attacks can be associated with state actors using commercial spyware developed by private companies.
One of the best-known examples is Pegasus, developed by NSO Group.
Apple does not, however, publicly attribute individual threat notifications to particular governments, companies or attackers. The company says revealing details about its detection methods could help spyware operators modify their behaviour and make future attacks more difficult to detect.
This means an Apple threat notification should be understood as a high-confidence warning that the company has detected activity consistent with an individual targeting operation, rather than as a public identification of a particular attacker.
Why Journalists and Activists Can Be Targets
Mercenary spyware attacks are often associated with individuals whose work or public profile may make them strategically important targets.
Apple’s guidance specifically identifies journalists, activists, politicians and diplomats among groups that have historically faced such attacks.
For these individuals, a compromised device can potentially expose sensitive communications, personal information, professional contacts and other data.
That is why Apple maintains a separate threat-notification system instead of relying only on standard security updates.
The company says most people will never be targeted by mercenary spyware. The attacks are highly selective and generally involve a much smaller number of individuals than ordinary malware campaigns.
New Lock-Screen Notifications Make Alerts More Visible
A notable development in the latest warnings is the way Apple is communicating with affected users.
Apple’s updated support information says threat notifications can be delivered through the company’s notification system, while its established process also includes messages associated with the user’s Apple Account.
The information supplied for the latest campaign says these warnings can now appear directly on the device lock screen.
That change is important because a person facing a sophisticated cyberattack needs to see the warning quickly.
Instead of requiring users to search through account settings or other locations, a lock-screen notification can immediately draw attention to the issue.
The alert directs affected users toward steps they can take to improve the security of their devices and accounts.
Apple Says Threat Alerts Are High-Confidence Warnings
Apple takes a cautious approach to its threat-notification system.
The company says its investigations cannot provide absolute certainty in every case, but it describes these notifications as high-confidence alerts that an individual may have been targeted by mercenary spyware.
Apple also keeps the precise indicators that trigger a warning confidential.
That is partly a defensive measure. If attackers understood exactly which behaviours, technical indicators or patterns Apple uses to identify suspected spyware activity, they could potentially alter their techniques to avoid detection.
The result is a warning system that prioritises giving the affected user actionable information while withholding technical details that could undermine future investigations.
What Users Should Do After Receiving an Alert
Apple recommends that users who receive a genuine threat notification take the warning seriously and strengthen the security of their devices.
The company’s guidance includes updating devices to the latest available software, protecting devices with a passcode, enabling two-factor authentication and using a strong, unique Apple Account password.
Apple also recommends installing applications through the App Store, using strong and unique passwords or passkeys for online accounts and avoiding links or attachments from unknown senders.
The company’s advice is relevant because sophisticated attacks can take advantage of outdated software, weak account security or other opportunities to gain access to a device or account.
Lockdown Mode Provides an Extra Layer of Protection
One of Apple’s most important recommendations for people at elevated risk is Lockdown Mode.
Apple describes Lockdown Mode as an optional, extreme protection designed for the very small number of individuals who may be targeted by highly sophisticated threats such as mercenary spyware.
When enabled, Lockdown Mode changes how the device operates.
Certain apps, websites and features are restricted to reduce the potential attack surface available to sophisticated attacks. This means users sacrifice some functionality in exchange for stronger security protections.
Apple says the feature is intended for specific high-risk situations rather than for the typical user.
The company’s guidance also makes clear that most people are never targeted by this type of attack.
Why Lockdown Mode Works Differently
Lockdown Mode is not simply another security setting that runs quietly in the background.
Apple deliberately limits functionality when the feature is activated because reducing the number of available pathways can make it harder for sophisticated spyware to exploit the device.
Apple’s security documentation says the mode can affect areas including Messages, Safari, FaceTime, Mail, connectivity and other system functions.
The trade-off is therefore clear: stronger protection comes with restrictions on convenience and functionality.
For someone who believes they may be the target of a sophisticated attack, that trade-off can be worthwhile.
Genuine Apple Alerts Will Not Ask for Your Password
Apple also warns users about a separate danger: fake messages pretending to be official threat notifications.
The company says legitimate threat notifications will never ask users to click a link, open a file, install an application or configuration profile or provide an Apple Account password or verification code through an email or phone request.
That distinction is important because cybercriminals can exploit public awareness of spyware campaigns by creating convincing-looking phishing messages.
Users who receive a notification should therefore verify it through Apple’s official account and support channels rather than trusting unexpected links or messages.
This is particularly important because a legitimate security alert should lead users towards protective measures, not ask them to disclose confidential credentials.
Apple Does Not Publicly Name the Attackers
Another feature of Apple’s approach is its reluctance to identify the suspected attacker behind an individual notification.
The company says it does not attribute specific notifications to particular attackers or geographic regions.
Apple argues that publicly disclosing information about its detection techniques could make it easier for spyware operators to evade future detection.
That means the notification primarily serves a protective purpose.
The user is told that Apple has detected activity consistent with a highly targeted spyware attack and is then provided with measures that can improve device security.
Spyware Threats Remain a Global Cybersecurity Issue
The latest alerts underline a broader trend in cybersecurity: sophisticated spyware is increasingly part of the global digital-security landscape.
While the overwhelming majority of people are unlikely to face mercenary spyware, the existence of such tools remains a concern for individuals in sensitive professions.
Journalists, activists and political figures can handle information that is valuable to governments or other powerful organisations, which can make their devices attractive targets.
Apple’s continued investment in threat notifications and Lockdown Mode reflects the company’s recognition that standard consumer security measures may not always be sufficient for the highest-risk users.
Apple’s Long-Term Focus on High-Risk Users
Apple introduced Lockdown Mode as part of a broader effort to protect people exposed to highly targeted attacks.
The company has described the feature as an extreme security measure intended for the very small number of people who face unusually sophisticated threats.
That strategy has evolved over time as Apple has expanded the protections available across its operating systems.
The company’s continued use of threat notifications also shows that security is not being treated as a one-time software feature.
Instead, Apple is monitoring the threat environment and communicating with affected users when it detects activity it believes is consistent with targeted spyware.
What the Latest 110-Country Alert Means
The latest notifications to users in 110 countries do not mean that every Apple user in those countries is at risk.
The alerts are targeted communications intended for individuals whom Apple believes may have been specifically targeted.
Apple’s own guidance emphasises that most people will never encounter mercenary spyware.
The significance of the latest campaign therefore lies in the sophistication of the threat and the number of countries involved, rather than in any suggestion of a broad attack against ordinary Apple customers.
For users who receive an actual Apple threat notification, however, the message should be taken seriously.
How Apple Is Balancing Security and Usability
The company’s approach illustrates the difficult balance between strong security and everyday convenience.
Regular users generally expect smartphones and computers to offer maximum functionality with minimal restrictions.
Lockdown Mode takes the opposite approach by deliberately reducing functionality to increase protection.
Apple’s threat-notification system occupies the middle ground: it informs users when the company believes they have been specifically targeted and points them towards stronger protections without imposing those restrictions on everyone.
That targeted approach helps Apple maintain normal usability for the wider customer base while giving high-risk users additional defensive tools.
The Message for iPhone, iPad and Mac Users
The latest Apple warnings provide an important reminder about the evolving nature of cybersecurity.
For ordinary users, maintaining updated software, using strong passwords, enabling two-factor authentication and remaining cautious around unknown links and attachments remain important security practices.
For the much smaller group of users who may be specifically targeted because of their profession or public role, Apple’s threat notifications and Lockdown Mode provide additional layers of defence.
The broader lesson is that sophisticated spyware is fundamentally different from everyday malware.
It is designed for specific targets, backed by substantial resources and capable of exploiting complex security weaknesses.
Apple’s latest notifications to users in 110 countries show that the company continues to treat that threat seriously.
As surveillance technology and cyberattack techniques evolve, the effectiveness of Apple’s warning system will depend on its ability to detect increasingly sophisticated activity while giving targeted users enough information to protect themselves without revealing details that attackers could exploit.
