Apple threat notifications went out to targeted users in 99 countries this week, and if you got one, you should treat it as real. Apple only sends these when it has high confidence that someone is being singled out by mercenary spyware. Here is what the alert means and what to do next.
The news broke on October 30, 2026. CyberScoop reports that recipients include journalists and documentary filmmakers, and that Apple has now notified users in more than 150 countries in total.
Quick Facts
- Apple sent the new batch on or just before October 30, 2026, to users in 99 countries.
- The alerts are for individual targeting, not mass malware campaigns.
- Apple does not say who attacked you or which spyware was used.
- Apple’s main advice: turn on Lockdown Mode and keep your devices updated.
- Not getting an alert does not prove you are clean.
Most people will never see one of these. But the steps below are useful for anyone who handles sensitive work.
What the Apple threat notifications actually say
Mercenary spyware is surveillance software sold to governments and other paying clients. It is built to quietly take over one person’s phone. Apple has been sending these warnings several times a year since 2021.
The last big batch before this one was in August 2026. BleepingComputer covered it then and said it reached users in 110 countries.
Apple calls these “high-confidence” alerts. It doesn’t blame a government, a company, or a region. So you shouldn’t assume a name like Pegasus just because it’s the best-known example.
How to tell a real alert from a scam
Scammers love this moment. A fake “Apple security alert” is an easy way to steal your Apple Account password. Compare what you received against this table.
| Check | Real Apple alert | Likely a scam |
|---|---|---|
| Where it shows up | Email and iMessage, and a banner at the top of account.apple.com after you sign in | Only a text, a call, or an email with no banner on your account page |
| Sender | Email from threat-notifications@email.apple.com | A lookalike address or a random number |
| What it asks | Nothing. It tells you to take the threat seriously | To click a link, open a file, install an app or profile, or share a code |
| Password or code | Never requested | Requested, often with a deadline |
The safest habit is to ignore any link in the message. Type account.apple.com into your browser yourself and look for the notice there.
What to do right now if you got one
Apple’s guidance is short, and it works in your favor to act quickly. Do these in order.
- Update every Apple device to the latest iOS, iPadOS, and macOS release.
- Turn on Lockdown Mode on each device.
- Contact Access Now, a digital rights group that runs a free helpline for at-risk people.
- Change your Apple Account password from a device you trust, and review which devices are signed in.
Updates matter most because spyware tends to use bugs that Apple has already fixed in newer builds. Our guide to the iOS 26.7.2 security update covers what the latest patches close.
How to turn on Lockdown Mode
On an iPhone, open Settings, tap Privacy & Security, scroll down to Lockdown Mode, and tap Turn On. Your phone will restart.
Lockdown Mode cuts down what attackers can reach. It blocks most message attachments, limits some web features, and blocks incoming invitations from people you haven’t contacted. Some sites and apps will feel a bit stricter, and you can still add trusted sites as exceptions.
It’s a trade-off. For a journalist or activist, it’s worth it. For everyone else, it’s optional.
Why no alert doesn’t mean you’re safe
Citizen Lab researcher John Scott-Railton told CyberScoop that not receiving a notification doesn’t rule out an infection. Apple’s alerts are one signal, not a full scan.
He also warned people to be careful with companies selling paid “spyware removal” services. Groups like Access Now and Citizen Lab are the usual places victims go for help, and they don’t charge for it.
Policy is moving too. The Pall Mall Process, a voluntary effort to set standards for commercial hacking tools, is reportedly nearing final negotiations. It’s a sign governments are paying attention, though it won’t stop the tools overnight.
Frequently Asked Questions
Does an Apple threat notification mean my iPhone is infected?
Not necessarily. It means Apple believes you were targeted. Treat it as serious, update, and turn on Lockdown Mode.
Which countries got the new alerts?
Apple said 99 countries but didn’t publish a list, according to CyberScoop. Apple has notified users in over 150 countries overall.
Will Apple tell me who is spying on me?
No. Apple doesn’t name attackers, governments, or the spyware involved.
Is Lockdown Mode free, and can I turn it off?
Yes to both. It’s built into iOS, iPadOS, and macOS, and you can switch it off in the same settings screen.
What if I got a message that looks like this but isn’t on my account page?
Don’t click anything. A real alert also appears when you sign in at account.apple.com, so no banner there is a red flag.
If you got an alert, update and enable Lockdown Mode today, then call Access Now. If you didn’t, spend two minutes updating your phone and learning what the real email looks like, so a fake one doesn’t catch you off guard. Related reading: the iOS 18.7.11 zero-day fix for older iPhones.
Leave a Reply