{"id":"CMP-202610-apple-sends-a-new-round-of-mercenary-spyware-threat-notifica","kind":"campaign","aliases":[],"related":[],"title":"Apple sends a new round of mercenary spyware threat notifications to targeted iPhone users in 99 countries, tied to new attacks","description":null,"summary":"On 30 Oct 2026 Apple began sending a new round of threat notifications. This round is separate from the August 2026 wave and is tied to new attacks. Costin Raiu relayed Apple's notice: this round goes to targeted users in 99 countries, and users in over 150 countries have been notified to date. The notifications warn people that they were individually targeted by mercenary spyware (Pegasus-class, often zero-click). Those at risk are mainly journalists, activists, lawyers, politicians, diplomats and senior executives and the staff around them. The spyware vendor, the exploit chain, the iOS versions affected and whether a patch exists are all unknown. Apple does not attribute these attacks.","severity":"medium","cvss":null,"epss":null,"exploited":true,"exploited_at":"2026-10-30T11:14:58+00:00","products":[{"name":"iOS","fixed":[],"affected":"unknown","ecosystem":"apple"},{"name":"Apple iPhone","fixed":[],"affected":"unknown","ecosystem":"apple"}],"ecosystems":[],"tags":["apple","campaign","early-warning","mercenary-spyware"],"not_affected_if":[],"how_to_check":"Ask high-risk staff (executives, legal, public-facing roles) whether they got an Apple Threat Notification: an alert on the iPhone Lock Screen and in Settings, an email to their Apple Account addresses, or a banner at the top of account.apple.com after signing in. A real notice never asks the user to click a link, open a file, install an app or profile, or give a password or code, so treat lookalike emails as phishing. No technical indicators have been published.","fix":"Anyone notified: turn on Lockdown Mode, update iOS/macOS to the latest version, and contact Access Now's Digital Security Helpline (24/7) for forensic help. Do not reset the phone before it has been examined. Security teams: consider requiring Lockdown Mode on high-risk users' devices and keeping managed Apple devices fully patched.","status":"open","published_at":null,"first_seen_at":"2026-10-30T11:14:58+00:00","triaged_at":"2026-10-30T11:14:58+00:00","updated_at":"2026-10-30T11:14:58+00:00","category":"vendor","confidence":null,"triage":null,"analyst_status":"done","analyst_note":null,"search":"'-202610':23A '150':93B '2026':49B,66B '30':47B '99':16A,87B 'a':27A 'activist':125B 'affect':146B 'appl':1A,38B,50B,77B,155B 'apple':25A,36A 'apple-sends-a-new-round-of-mercenary-spyware-threat-notifica':24A 'around':135B 'attack':21A,73B,160B 'attribut':158B 'august':65B 'began':51B 'campaign':39B 'chain':142B 'class':114B 'click':118B 'cmp':22A 'costin':74B 'countri':17A,88B,94B 'date':99B 'diplomat':128B 'earli':41B 'early-warn':40B 'execut':131B 'exist':151B 'exploit':141B 'goe':82B 'individu':107B 'io':144B 'ios':35A 'iphon':13A 'iphone':37A 'journalist':124B 'lawyer':126B 'main':123B 'mercenari':7A,44B,110B 'mercenary':31A 'mercenary-spywar':43B 'new':4A,20A,28A,54B,72B 'notic':79B 'notif':10A,58B,101B 'notifi':97B 'notifica':34A 'oct':48B 'of':30A 'often':115B 'patch':150B 'pegasus':113B 'pegasus-class':112B 'peopl':103B 'politician':127B 'raiu':75B 'relay':76B 'risk':121B 'round':5A,29A,55B,60B,81B 'send':2A,52B 'sends':26A 'senior':130B 'separ':62B 'spywar':8A,45B,111B,138B 'spyware':32A 'staff':134B 'target':12A,84B,108B 'threat':9A,33A,57B 'tie':18A,70B 'unknown':154B 'user':14A,85B,90B 'vendor':139B 'version':145B 'warn':42B,102B 'wave':67B 'whether':148B 'zero':117B 'zero-click':116B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"A","verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"first_public_at":"2026-08-13T00:00:00+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"analyst","external_id":"CMP-202610-apple-sends-a-new-round-of-mercenary-spyware-threat-notifica","url":null,"severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-30T11:14:58+00:00","fetched_at":"2026-10-30T11:14:58+00:00","note":null}],"documents":[{"id":23020,"url":"https://x.com/craiu/status/2116125797618467097","title":"@craiu: Heads-up: New round of Apple Threat Notifications is going out right now, distin","kind":"post","source":"x","publisher":null,"text":"Heads-up: New round of Apple Threat Notifications is going out right now, distinct from the August wave and tied to new attacks!\n\nApple’s notice: \n\n“Today’s notification is being sent to targeted users in 99 countries, and to date we have notified users in over 150 countries in https://t.co/sBEA3VTFHl\n\nlikes 194 reposts 44","published_at":"2026-10-30T11:11:20+00:00","relation":"describes","confidence":null,"note":null},{"id":23023,"url":"https://support.apple.com/en-us/102174","title":"Apple: About Apple threat notifications and protecting against mercenary spyware","kind":"vendor","source":"analyst","publisher":null,"text":"Apple threat notifications are high-confidence alerts that a user was individually targeted by mercenary spyware. Delivered as an alert on iPhone Lock Screen and in Settings, an email to the Apple Account addresses, and a banner at account.apple.com. Apple never asks recipients to click links, open files, install apps or profiles, or give a password or code. Recommends enabling Lockdown Mode and contacting Access Now's Digital Security Helpline. Sent multiple times a year since 2021; users in over 150 countries notified to date. Apple does not attribute the attacks.","published_at":"2026-08-13T00:00:00+00:00","relation":"describes","confidence":null,"note":null},{"id":23856,"url":"https://x.com/jsrailton/status/2116170989314703847","title":"@jsrailton: ALERT:  did you just get a threat notification from Apple?\n\nSeek expert help.\n\nA","kind":"post","source":"x","publisher":null,"text":"ALERT:  did you just get a threat notification from Apple?\n\nSeek expert help.\n\nApple just sent new notifications about mercenary spyware.\n\nHere are steps to take right now. 1/ https://t.co/7FzBVwgSyZ\n\nlikes 107 reposts 32","published_at":"2026-10-30T14:10:55+00:00","relation":"discussion","confidence":null,"note":null},{"id":23869,"url":"https://x.com/jsrailton/status/2116174267142279286","title":"@jsrailton: 2/ Step 1: Check your iPhone settings to make sure the notification is real.\n\nIf","kind":"post","source":"x","publisher":null,"text":"2/ Step 1: Check your iPhone settings to make sure the notification is real.\n\nIf you got a genuine Apple Threat Notification, it will be there.\n\nhttps://t.co/n9YvF1InmX https://t.co/3oWAgo0G6A\n\nlikes 14 reposts 3","published_at":"2026-10-30T14:23:56+00:00","relation":"discussion","confidence":null,"note":null},{"id":23870,"url":"https://x.com/jsrailton/status/2116175528969281951","title":"@jsrailton: 3/ Step 2: Confirmed Apple Threat Notification? \n\nSeek expert help.\n\nI agree wit","kind":"post","source":"x","publisher":null,"text":"3/ Step 2: Confirmed Apple Threat Notification? \n\nSeek expert help.\n\nI agree with @apple, you should get in touch the @accessnow helpline (for civil society).\n\nHere's the link: https://t.co/isU1TjW7kK https://t.co/YR0z99jELc\n\nlikes 11 reposts 2","published_at":"2026-10-30T14:28:57+00:00","relation":"discussion","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}