---
id: "CMP-202610-apple-sends-a-new-round-of-mercenary-spyware-threat-notifica"
kind: "campaign"
aliases: []
title: "Apple sends a new round of mercenary spyware threat notifications to targeted iPhone users in 99 countries, tied to new attacks"
severity: "medium"
cvss: null
epss: null
exploited: true
status: "open"
category: "vendor"
products: [{"name": "iOS", "fixed": [], "affected": "unknown", "ecosystem": "apple"}, {"name": "Apple iPhone", "fixed": [], "affected": "unknown", "ecosystem": "apple"}]
ecosystems: []
tags: ["apple", "campaign", "early-warning", "mercenary-spyware"]
not_affected_if: []
published_at: null
first_seen_at: "2026-10-30T11:14:58+00:00"
updated_at: "2026-10-30T11:14:58+00:00"
sources: [{"source": "analyst", "url": null, "first_seen_at": "2026-10-30T11:14:58+00:00"}]
---

# Apple sends a new round of mercenary spyware threat notifications to targeted iPhone users in 99 countries, tied to new attacks

On 30 Oct 2026 Apple began sending a new round of threat notifications. This round is separate from the August 2026 wave and is tied to new attacks. Costin Raiu relayed Apple's notice: this round goes to targeted users in 99 countries, and users in over 150 countries have been notified to date. The notifications warn people that they were individually targeted by mercenary spyware (Pegasus-class, often zero-click). Those at risk are mainly journalists, activists, lawyers, politicians, diplomats and senior executives and the staff around them. The spyware vendor, the exploit chain, the iOS versions affected and whether a patch exists are all unknown. Apple does not attribute these attacks.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- apple:iOS affected unknown fixed ?
- apple:Apple iPhone affected unknown fixed ?

## How to check

Ask high-risk staff (executives, legal, public-facing roles) whether they got an Apple Threat Notification: an alert on the iPhone Lock Screen and in Settings, an email to their Apple Account addresses, or a banner at the top of account.apple.com after signing in. A real notice never asks the user to click a link, open a file, install an app or profile, or give a password or code, so treat lookalike emails as phishing. No technical indicators have been published.

## Fix

Anyone notified: turn on Lockdown Mode, update iOS/macOS to the latest version, and contact Access Now's Digital Security Helpline (24/7) for forensic help. Do not reset the phone before it has been examined. Security teams: consider requiring Lockdown Mode on high-risk users' devices and keeping managed Apple devices fully patched.

## Timeline

- 2026-10-30T11:14:58+00:00 analyst

## Documents

- [describes] @craiu: Heads-up: New round of Apple Threat Notifications is going out right now, distin https://x.com/craiu/status/2116125797618467097
- [describes] Apple: About Apple threat notifications and protecting against mercenary spyware https://support.apple.com/en-us/102174
- [discussion] @jsrailton: ALERT:  did you just get a threat notification from Apple?

Seek expert help.

A https://x.com/jsrailton/status/2116170989314703847
- [discussion] @jsrailton: 2/ Step 1: Check your iPhone settings to make sure the notification is real.

If https://x.com/jsrailton/status/2116174267142279286
- [discussion] @jsrailton: 3/ Step 2: Confirmed Apple Threat Notification? 

Seek expert help.

I agree wit https://x.com/jsrailton/status/2116175528969281951

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_