Apple sent a new round of spyware threat notifications in August 2026 to iPhone users in 110 countries, warning them that government-grade mercenary spyware may have targeted their devices. The alerts appeared directly on recipients’ iPhone lock screens as push notifications, marking an updated approach to how Apple delivers these warnings.
The push notification reads: “Apple detected a mercenary spyware attack targeted at your iPhone. There are actions you can take now to protect your data and device.” Apple also sends the alerts by email and through account login pages. The company says it has now notified customers in over 150 countries since it first introduced spyware alerts in 2021.
Apple told TechCrunch it updated the user experience to make it easier for recipients to access guidance on next steps. The notification directs users to enable Lockdown Mode, a security feature that significantly limits the attack surface for spyware. Apple says it has not recorded a single case of a device being successfully compromised while Lockdown Mode was active.
John Scott-Railton, a senior researcher at Citizen Lab, called the push notifications a “big improvement” over earlier alert methods. He noted that spyware alerts have real investigative consequences: “Notifications create a critical signal that a community is being targeted. People get an alert, and then some of them reach out and seek help. Often this kicks off an investigation that reveals many, many more cases.” Scott-Railton credited Apple’s notification system with helping expose the spyware abuse scandal involving Poland’s former government.
Spyware attacks remain relatively uncommon, but the technology has increasingly been used by governments against journalists, activists, and political rivals. Receiving an Apple threat notification does not confirm a device was successfully hacked, but Apple and security researchers advise taking immediate protective steps regardless.
Source: TechCrunch