Apple has recently informed certain iPhone users across 99 countries about potential attacks from advanced mercenary spyware. This notification was shared by security expert Costin Raiu on October 30, 2026, highlighting its distinction from previous alerts issued in August.
Global Notification Efforts
The tech giant’s statement, shared by Raiu, indicated that these warnings are part of a larger effort that has reached users in more than 150 countries. While Apple has not disclosed the identities of the attackers or specified affected regions, it emphasizes the wide-reaching nature of these security threats.
The current wave of notifications follows a similar warning in August, which covered 110 countries. These alerts point to targeted locations rather than a confirmed number of compromised devices, reflecting Apple’s high confidence in identifying potential threats without confirming device breaches.
Understanding Mercenary Spyware
Apple’s guidelines describe mercenary spyware as complex operations that require significant resources to target a limited group of individuals. These attacks, often costing millions, typically focus on journalists, activists, political figures, and diplomats.
Unlike mass phishing campaigns, these targeted attacks pose a substantial challenge due to their high cost, intricate technical execution, and brief duration. Apple’s investigations depend on internal threat intelligence, and details of detection methods are kept confidential to prevent attackers from adapting.
Protection Measures and Recommendations
Apple has not directly linked any specific spyware product or delivery mechanism, such as Pegasus, to this alert wave. The company provides threat notifications through various channels, including iPhone Lock Screen alerts, Settings, and emails associated with Apple Accounts.
To verify the authenticity of these alerts, recipients should access Apple’s account site independently, ensuring they are not misled by phishing attempts. Apple advises users to consider these notifications seriously and to consult security experts for guidance.
For individuals facing these threats, Apple recommends enabling Lockdown Mode, which restricts certain device functionalities that could be exploited. This mode is accessible via Settings under Privacy & Security on iPhones. Users are encouraged to update their devices and enable protection on all supported devices.
Conclusion and Future Outlook
Apple’s proactive measures aim to mitigate the risks of sophisticated spyware attacks. By urging vigilance and recommending Lockdown Mode, Apple seeks to strengthen users’ defenses against these advanced threats. While most users will not encounter mercenary spyware, maintaining updated software and secure account practices remains crucial for all.
For ongoing support, notified users are directed to Access Now’s Digital Security Helpline, while others are reminded of the importance of robust cybersecurity practices in an increasingly digital world.
