Security Operations

Apple sends new spyware threat alerts to users in 99 countries

Apple’s new mercenary spyware alerts reach 99 countries, per notice text shared by Costin Raiu. How UK security teams should respond.

Warning graphic for Apple's mercenary spyware threat notifications sent to users in 99 countries

Apple has begun another round of mercenary spyware threat notifications, its second in roughly eleven weeks, reaching targeted users in 99 countries according to the alert text. For UK security teams, the practical question is what to do when one of those alerts lands on a phone belonging to a director, a journalist or a member of staff.

What happened

On Friday 30 October 2026, Apple started sending fresh threat notifications to iPhone users it believes have been individually targeted by mercenary spyware. Apple has made no public statement. The scale comes from the notice itself, which researcher Costin Raiu, formerly of Kaspersky, shared as the alerts went out. According to that text, the batch went to targeted users in 99 countries, and Apple has now warned users in more than 150 countries since the programme began in 2021.

Reports based on the notice describe this wave as separate from the previous one and tied to active campaigns. That earlier round went out on 13 August to users in 110 countries and was the first to show up as a Lock Screen alert rather than only by email. Apple’s support page still carried the August date when this round began, so the 99-country figure rests on the alert text, not a formal announcement.

CyberScoop reported that those notified include journalists and documentary makers. Apple did not answer its questions about which countries were involved, and, as with every previous round, the company does not attribute the activity to any vendor, government or region.

The technical picture

The public record is thin by design. Apple has not named a spyware product, an exploit chain, a delivery route or a vulnerability behind this wave. It says it holds back its detection methods so that spyware developers cannot learn to evade them. Pegasus appears in Apple’s guidance purely as a historical example of the category, so anyone pinning this round on NSO Group or a competitor is going beyond the evidence.

What Apple does say is that its alerts reflect high confidence that a specific person was targeted. That is not the same as confirmed compromise. A country count also tells you nothing about the number of victims: it describes how widely the batch was spread, and Apple has never revealed how many individuals receive each round.

Genuine alerts are shown in Settings and on the Lock Screen, sent by email to the Apple Account address, and as a notice shown after signing in to account.apple.com. According to Apple, a real warning will never request passwords or codes, push the user towards links or attachments, or ask for software or profiles to be installed. Lockdown Mode, the hardened setting Apple recommends for those at risk, restricts message attachments, some web technologies, some incoming FaceTime calls and profile installation, cutting down the attack surface that zero-click exploits tend to rely on.

Checklist of six steps for UK organisations responding to an Apple mercenary spyware threat notification

Why it matters for UK organisations

Most UK firms will never see one of these notices. The ones that do tend to be the organisations where a single compromised phone is most damaging: newsrooms, law firms handling sensitive disputes, NGOs and charities working on human rights, think tanks, defence and government suppliers and firms whose executives travel to high-risk regions. A senior figure’s iPhone usually holds email, messaging, calendar, authenticator apps and access to corporate SaaS, so a successful implant can serve as a quiet route into the business, not only into the individual’s private life.

There is also a policy thread running through Westminster. The UK and France co-lead the Pall Mall Process, launched at Lancaster House in February 2024 to curb the misuse and proliferation of commercial hacking tools. Its Code of Practice for States was agreed in April 2025 and has backing from more than 27 countries, and a UK-French consultation on good practice for the industry itself closed in January. CyberScoop notes that this new wave lands just before the final rounds of negotiation on those industry guidelines.

Expert view

In my experience, the weakest point in handling these alerts is not technical. It is the fact that the alert goes to the individual, not to the security team. A board member gets an alarming message on a Friday and the organisation hears days later, if at all. By then the opportunity to preserve useful evidence on the device may have gone.

The second risk is phishing. Every high-profile wave of Apple notifications creates cover for lookalike emails that do exactly what genuine ones never do: push a link, ask for credentials or prompt a profile install.

Third, treat the outside help market with care. John Scott-Railton of Citizen Lab, as paraphrased by CyberScoop, warned against firms selling paid clean-up services, and pointed out that the absence of an alert does not prove a phone is clean. Access Now’s Natalia Krapiva argued that the current system “is not working” while repressive states keep using these tools. I would agree with both: a notification is a signal for structured response, not a reason to hand a device to whoever answers first.

Finally, keep perspective. These operations are expensive and narrowly aimed. Apple itself says most users will never be targeted. The job is making sure the few people at risk know what to do.

What to do now

  1. Tell high-risk staff to report alerts to you first. Identify executives, journalists, legal and policy staff who are plausible targets, and give them a single route to the security team, out of hours included.
  2. Verify, never click. Confirm a notice only by going straight to account.apple.com and signing in. Treat any message asking for links, files, profiles, passwords or codes as phishing.
  3. Preserve before you wipe. Do not factory reset a phone that has been flagged. Isolate it, note the time and content of the alert, and get specialist forensic advice. Access Now’s Digital Security Helpline is available to recipients around the clock.
  4. Turn on Lockdown Mode for flagged users and consider it pre-emptively for your highest-risk people, after updating devices to the latest iOS. Test business apps first, as some features behave differently.
  5. Contain the corporate blast radius. Revoke sessions and tokens tied to the device, rotate credentials, re-enrol phishing-resistant MFA on a clean device and review mailbox rules and recent sign-ins. This maps to the Cyber Essentials controls on user access control and security update management.
  6. Enforce patching through MDM. Require current iOS versions for corporate data access and block outdated devices.
  7. Brief everyone on lookalike alerts now, while the wave is fresh and phishing using it is most likely.

Bottom line

Apple’s latest round of alerts, reaching 99 countries according to the notice Raiu shared, shows mercenary spyware remains a live problem more than two years into the Pall Mall Process. Most UK organisations need no more than an awareness note. Those with high-profile people should make sure an alert reaches the security team within hours, the device is preserved, and corporate access is cut and rebuilt cleanly.

Sources

Related Posts