Apple has deployed a fresh round of high-confidence Threat Notification alerts to users across 110 countries, warning individuals that their iPhones are being targeted by sophisticated mercenary spyware attacks. According to official company documentation published by Apple, these alerts are designed to identify individuals targeted due to their identity or professional activities, distinguishing them from standard cybercriminal activity.
Global Scale and Target Profiles
The global spyware alerts reach users in more than 150 countries cumulatively since Apple began issuing the warnings in 2021, according to company support records. These campaigns are exceptionally well-funded, often costing millions of dollars to execute, and maintain a short operational shelf life to evade detection. Apple notes in its documentation that targets historically include journalists, activists, politicians, and diplomats who face state-sponsored digital espionage.
While the company does not attribute specific campaigns to particular geographic regions or threat groups, public reporting and cybersecurity research historically link mercenary spyware—such as Pegasus from the NSO Group—to state-backed actors and private firms developing custom exploits. BleepingComputer reported that users began sharing screenshots and details of the August 13 alerts on platforms like Reddit, marking another wave in Apple’s ongoing notification cycle.
Verifying Authentic Apple Threat Notifications
Because sophisticated phishing campaigns often attempt to mimic security warnings, Apple outlines strict verification steps for notification recipients. According to Apple’s security guidelines, genuine threat notifications appear in three specific locations:
- On the user’s iPhone Lock Screen immediately upon delivery.
- Inside the Settings menu on compatible iOS devices.
- At the top of the account management page after signing in directly at account.apple.com.
Official notifications are also delivered via email and iMessage from the dedicated address threat-notifications@email.apple.com. Apple explicitly states that legitimate alerts never direct users to click links, open files, install configuration profiles, or provide an Apple Account password and verification codes.
Recommended Defense Steps for Targeted Users
Recipients of the August 13 threat alerts are urged to take immediate protective action. Apple recommends enabling Lockdown Mode on supported devices, a specialized security setting that hardens system defenses and limits specific device functionalities to block complex attack vectors.
Additionally, the company advises notified individuals to seek rapid-response emergency assistance from independent organizations. Victims can contact the Digital Security Helpline operated by the nonprofit Access Now, which provides 24/7 tailored security guidance for high-risk digital targets navigating active mercenary spyware incidents.
Worth a look