Apple has sent a new round of threat notifications to iPhone users in 110 countries, alerting them they may have been targeted by mercenary spyware attacks. The alerts went out on August 13, 2026, reaching an unspecified number of users, according to a confirmation Apple provided to TechCrunch.
The company describes these as high-confidence alerts that a user has been individually targeted, though it does not attribute the attacks to any specific attackers or geographical regions. Apple keeps its detection methods secret so attackers cannot adapt their behavior to evade future identification, and it notes that receiving a notification does not prove a device was compromised, only that matching suspicious activity was spotted.
These attacks are vastly more sophisticated than regular cybercriminal activity, with attackers applying exceptional resources against a very small number of specific individuals. Mercenary spyware campaigns cost millions of dollars and often have a short shelf life, making them harder to detect and prevent.
The targets are typically journalists, activists, politicians, and diplomats, though the attacks are ongoing and global in scope.
Apple has been running this warning program since 2021, sending notifications multiple times a year as attacks are detected. To date, the company has notified users in over 150 countries in total.
The current wave does not name a specific spyware maker, though Apple has previously pointed to NSO Group's Pegasus as an example of mercenary spyware developed by private companies on behalf of state actors.
Users who receive a warning are advised to enable Lockdown Mode, which limits certain iPhone features to make attacks harder to execute. Apple also recommends contacting the Digital Security Helpline run by the nonprofit Access Now, which offers free around-the-clock assistance.
As of 2026, Apple delivers these alerts directly on iPhone and via email from [email protected], with notification types varying based on the user's device model and software version. Apple warns that a legitimate notification will never ask recipients to click a link, open a file, install an app or profile, or provide their Apple Account password.
The vast majority of iPhone users will never be targeted by such attacks, Apple says, and the company relies solely on its internal threat-intelligence investigations to detect them. Apple has not said whether this latest round is tied to any single spyware campaign or group.
