● Covered by 9 sources · 11 reportsMedium impact3 negative8 neutral
Apple Issues New Spyware Threat Notifications to Users in 110 Countries
Key points
- Apple notified users in 110 countries about mercenary spyware attacks.
- Notifications now appear on iPhone lock screens with protection advice.
- Apple has alerted users in over 150 countries since 2021.
- Targeted individuals include journalists, activists, and diplomats.
- Users are advised to enable Lockdown Mode for protection.
- Apple sent notifications on Thursday.
- Apple began sending threat notifications in late 2021.
- Apple sent notifications on Friday.
- Digital rights groups and cybersecurity firms report a significant increase in users seeking help.
- Mohammed Al-Maskati is the director of Access Now's investigation team.
- Apple began placing threat notifications on Lock Screen and Settings in September.
- Apple's notifications do not confirm if a spyware attack succeeded.
- Apple's notifications do not identify who is behind an attack.
- Apple's notifications do not state the motives behind an attack.
- NSO Group, Paragon, and Cytrox sell commercial surveillance technology.
- Pegasus spyware infected a Serbian student activist's iPhone.
- Citizen Lab and SHARE Foundation reported the infection.
- An iMessage zero-click exploit infected the device.
- Infection indicators were found from December 2025 to January 2026.
- The zero-click exploit was addressed by iOS 18.4.1.
- iOS 18.4.1 was released in April 2025.
- At least 14 people in Serbia have been targeted since early 2026.
- Targets in Serbia include student movement members, activists, a member of parliament, and a local councilor.
- Targeting coincided with local elections in March.
- Two different types of spyware were found on victims' phones.
- A new Android spyware, NoviSpy, was identified.
- Amnesty International peer-reviewed SHARE Foundation's findings.
- The wave of spyware infections was discovered in August.
- Citizen Lab released an analysis on Wednesday.
- The student movement has been active since 2024.
- The student movement coalesced after a train station collapse.
New Wave of Threat Notifications
Apple has issued a new series of threat notifications to customers suspected of being targeted by mercenary spyware. These alerts were sent to users in 110 countries, indicating that their iPhones, iPads, or Macs might have been compromised. This latest round of warnings contributes to Apple's ongoing effort, which has seen customers in over 150 countries notified to date.
Enhanced Notification Experience
The company has updated its user experience for these warnings. Notifications will now appear directly on the iPhone lock screen as a push notification, urging recipients to take action. The message reads: “Apple detected a mercenary spyware attack targeted at your iPhone. There are actions you can take now to protect your data and device.” Apple also sends notifications via email and when users log in to their accounts.
A new support article titled “About Apple threat notifications and protecting against mercenary spyware” has been published, detailing what these notifications are, how they are delivered, and recommended protective measures.
Targeted Attacks and Protection
Mercenary spyware attacks are typically highly sophisticated and expensive, aimed at a small number of individuals rather than the general public. These targets often include journalists, activists, politicians, and diplomats. The spyware can bypass encryption to access private files, monitor conversations, capture audio and video, track locations, and control devices.
Apple advises anyone who receives a threat notification to enable Lockdown Mode on their iPhone, iPad, or Mac. This mode provides extreme, optional protection for devices against highly targeted cyberattacks.
Background on Apple's Alerts
Apple has been sending these threat notifications multiple times a year since 2021, when it began detecting highly targeted mercenary spyware attacks. While Apple does not identify the specific spyware behind individual alerts, it has cited NSO Group's Pegasus as an example of mercenary spyware historically associated with this type of attack. Forensic investigations into previous Apple threat notifications have confirmed Pegasus infections in some cases.
Updates
- The wave of spyware infections was discovered in August.
- Citizen Lab released an analysis on Wednesday.
- The student movement has been active since 2024.
- The student movement coalesced after a train station collapse.
- Targeting coincided with local elections in March.
- Two different types of spyware were found on victims' phones.
- A new Android spyware, NoviSpy, was identified.
- Amnesty International peer-reviewed SHARE Foundation's findings.
- Pegasus spyware infected a Serbian student activist's iPhone.
- Citizen Lab and SHARE Foundation reported the infection.
- An iMessage zero-click exploit infected the device.
- Infection indicators were found from December 2025 to January 2026.
- The zero-click exploit was addressed by iOS 18.4.1.
- iOS 18.4.1 was released in April 2025.
- At least 14 people in Serbia have been targeted since early 2026.
- Targets in Serbia include student movement members, activists, a member of parliament, and a local councilor.
- Apple began placing threat notifications on Lock Screen and Settings in September.
- Apple's notifications do not confirm if a spyware attack succeeded.
- Apple's notifications do not identify who is behind an attack.
- Apple's notifications do not state the motives behind an attack.
- NSO Group, Paragon, and Cytrox sell commercial surveillance technology.
- Apple sent notifications on Friday.
- Digital rights groups and cybersecurity firms report a significant increase in users seeking help.
- Mohammed Al-Maskati is the director of Access Now's investigation team.
- Apple sent notifications on Thursday.
- Apple began sending threat notifications in late 2021.
✨ This summary was generated by AI from the outlets' reporting listed below. It is not independently verified and may contain errors — check the original sources. How BrevFeed works →
The daily brief
One email each morning: the day's tech stories, clustered across outlets and summarized. No account needed.
One email a day. Unsubscribe in one click, any time.
Today's brief
Spend a few minutes, get the whole day. Every topic's top stories in one hands-free rundown — listen, watch, or read the transcript.
▶ Play today's brief
New every morning, and the back catalogue is archived by date.
Primary sources
GitHub uuidjs/uuidHow outlets covered it
At least 14 individuals in Serbian civil society were targeted with advanced spyware, including NSO Group's Pegasus, in what the Share Foundation describes as the largest documented surveillance wave in Serbia. This incident highlights the use of sophisticated tools against pro-democracy movements, raising concerns about digital rights and potential government involvement ahead of upcoming elections.
At least 14 Serbian opposition figures and activists were targeted with advanced spyware, including Pegasus and a new Android variant called NoviSpy, coinciding with local elections. Digital forensic researchers confirmed infections, with one victim's messages appearing on a pro-government TV network, indicating a pattern of digital surveillance against critical voices.
Citizen Lab and SHARE Foundation reported that NSO Group's Pegasus spyware infected a Serbian student activist's iPhone via an iMessage zero-click exploit. This incident is part of a broader pattern of advanced spyware targeting activists and opposition figures in Serbia, with at least 14 individuals affected since early 2026.
Apple has updated its threat notification system to display alerts directly on device Lock Screens and in Settings, making them more prominent for users targeted by mercenary spyware. These notifications indicate detected activity suggesting a spyware attack, prompting users to seek digital forensic investigation from experts like Access Now's Digital Security Helpline.
Apple recently sent out a large wave of threat notifications to users in 110 countries, warning them of suspected "mercenary spyware" attacks. Digital rights groups and cybersecurity firms report a significant increase in users seeking help after receiving these alerts, indicating this batch is the largest yet.
Apple issued threat notifications to users in 110 countries regarding targeted mercenary spyware attacks on iPhones, iPads, and Macs. These attacks are aimed at high-profile individuals like journalists and politicians, and Apple advises enabling Lockdown Mode to protect devices.
Apple issued threat notifications to users in 110 countries suspected of being targeted by mercenary spyware. These alerts are high-confidence warnings for individuals like journalists and activists, indicating sophisticated, resource-intensive attacks.
Apple has sent out a new round of notifications to users it believes have been targeted by mercenary spyware attacks, such as Pegasus. The company also updated its user experience for these warnings and published a new support page detailing mercenary spyware and protective measures, including enabling Lockdown Mode.
Apple has sent out a new batch of "Threat Notification" alerts to users whose iPhones are suspected of being targeted by mercenary spyware. These notifications, which Apple has issued since 2021, indicate highly sophisticated and expensive attacks typically aimed at a small number of individuals like journalists, activists, and diplomats.
Apple has notified users in 110 countries about potential mercenary spyware attacks, bringing the total number of countries alerted over the past few years to more than 150. The company also released a new support article detailing threat notifications and security recommendations.
Apple has sent out a new round of push notifications to users in 110 countries, alerting them to potential mercenary spyware attacks on their devices. These notifications, which now appear directly on the iPhone lock screen, advise users on steps to protect their data and devices, including enabling Lockdown Mode.