Press play to start listening
Apple has updated how it delivers threat notifications to people it believes have been individually targeted by mercenary spyware. The company now displays an alert on the user’s iPhone Lock Screen and in Settings, depending on the device model and software version.
The warning reads: “Apple detected a mercenary spyware attack targeted at your iPhone. There are actions you can take now to protect your data and device.”
The Lock Screen alert gives recipients immediate access to information about what happened and what they should do next. Apple will continue sending notifications to email addresses associated with the user’s Apple Account and displaying a warning at the top of account.apple.com after sign-in.
Why Mercenary Spyware Is a Threat
Apple uses the term “mercenary spyware” to refer to advanced commercial surveillance tools developed by private companies. Pegasus spyware by Israeli firm the NSO Group is the most prominent example. These tools are generally used to target specific individuals because of who they are or what they do, and as Hackread.com has been observing, these are usually deployed against journalists, activists, political figures, and other members of civil society.
Some mercenary spyware campaigns use zero-click exploits, which can compromise a device without requiring the target to tap a link or open a file. Once compromised, spyware can secretly capture private messages, record calls, and track live locations.
What the New Lock Screen Alerts Change
Apple’s latest update is primarily about how quickly and clearly users receive the warning, rather than stopping the spyware attack itself. The company urges affected individuals to update their device software to the latest version and turn on Lockdown Mode. This built-in security feature restricts certain device functions to reduce the number of attack routes available to mercenary spyware.
Apple does not attribute its threat notifications to specific attackers or regions and does not disclose what triggered an individual warning. The company describes the notices as high-confidence alerts that a person has been individually targeted, although receiving one does not confirm that the device was successfully compromised.
John Scott-Railton, a senior researcher at Citizen Lab, described the Lock Screen notifications as a “big improvement” because they make it easier for recipients to seek help. He said such warnings can also lead researchers to identify additional victims connected to the same campaign.
Apple says it is not aware of any successful mercenary spyware attack against an Apple device while Lockdown Mode was enabled.
“As researchers, we see a lot of people that get targeted with spyware. Using Lockdown Mode is one of the best things people do to become harder to hack,” Scott-Railton noted in a post on X.
What to Do If Apple Sends a Warning
An Apple threat notification should be taken seriously, but receiving one does not necessarily mean the device was successfully compromised. Apple advises recipients to seek specialist assistance from Access Now’s Digital Security Helpline, which provides free emergency support 24 hours a day. Users can verify whether a warning is genuine by signing in directly at account.apple.com, where the notification will appear at the top of the page.
Apple sent the latest batch of notifications on Thursday to targeted users in 110 countries. The company has issued such warnings several times a year since 2021 and says recipients in more than 150 countries have now been notified. Email warnings and notices on the Apple Account website will continue alongside the new Lock Screen and Settings alerts.
