Apple Warns iPhone Users in 99 Countries of Sophisticated Mercenary Spyware Attacks

Apple has issued a fresh round of threat notifications to selected iPhone users in 99 countries, warning that they have been targeted by sophisticated mercenary spyware attacks. Security researcher Costin Raiu reported the new wave on October 30, 2026, saying it was separate from August’s alerts and linked to new attacks.

“Today’s notification is being sent to targeted users in 99 countries, and to date we have notified users in over 150 countries in total,” Apple said in the notice shared by Raiu. The company did not name the attackers or connect the warnings to any specific region.

The latest warnings follow the August spyware alerts covering 110 countries. These figures describe where notified users were located, not the number of victims or confirmed infections. Apple’s alerts identify targeting with high confidence, but they do not automatically establish that an attacker successfully took control of every notified device.

According to Apple’s threat notification guidance, mercenary spyware operations use exceptional resources to target a small number of people. Attacks can cost millions of dollars and often focus on journalists, activists, politicians, and diplomats because of their work or public role.

Unlike broad phishing campaigns, these operations are built around specific targets. Apple says their high cost, technical complexity, and short lifespan make them difficult to detect and prevent. Its investigations rely on internal threat intelligence, and the company withholds detection details to prevent attackers from learning how to avoid its systems.

Apple has not publicly identified a spyware product, delivery method, or software flaw behind this notification wave. Naming Pegasus or another commercial surveillance tool as responsible would therefore go beyond the available evidence. Apple’s guidance discusses Pegasus as a historical example, not an attribution for these attacks.

Apple now delivers threat warnings through iPhone Lock Screen alerts, Settings, and emails linked to the user’s Apple Account. A notification banner also appears after the recipient signs in to their account. Delivery options can vary with the device model and software version.

Recipients should independently open Apple’s account website and check for the banner. Genuine threat notifications never ask users to install apps or configuration profiles, open files, or share passwords and verification codes. This verification step helps distinguish a real warning from a phishing message copying Apple’s branding.

As covered in earlier reporting on Apple’s spyware warnings, recipients should treat these alerts as serious security events and seek expert help rather than dismiss them as routine notices.

Apple recommends Lockdown Mode for people facing these threats. Its Lockdown Mode documentation explains that the feature limits message attachments, some web technologies, incoming FaceTime calls, and profile installation, reducing functions that attackers could exploit.

On iPhone, users can find it under Settings, Privacy & Security, then Lockdown Mode. Apple advises updating devices first and enabling protection across supported devices. Some websites and features may work differently afterward.

Apple also directs notified users to Access Now’s Digital Security Helpline for round-the-clock expert assistance. For everyone else, current software, strong account protection, and caution with unknown links remain important. Apple says most users will never face mercenary spyware targeting.

AI is making cyberattacks faster and cheaper. Are your defenses ready to respond at machine speed?

The post Apple Warns iPhone Users in 99 Countries of Sophisticated Mercenary Spyware Attacks appeared first on Cyber Security News.