Apple push notification alerts about potential spyware attacks have begun appearing on iPhones, iPads and Macs worldwide, prompting users to act quickly.
Apple expands warning system to more than 110 countries
On Thursday, the company sent lock‑screen alerts to customers in 110 nations it believes may have been targeted by sophisticated spyware often linked to government operations. It says it has now warned users in over 150 countries since the program started, illustrating how far such surveillance tools have spread.
The notification reads, “Apple detected a mercenary spyware attack targeted at your iPhone. There are actions you can take now to protect your data and device.” Recipients will also receive an email and a prompt when they sign in to their Apple ID.
Support documentation notes that the new design makes it easier for users to follow the recommended steps, including turning on Lockdown Mode—a setting that hardens the device against exploit attempts. According to the firm, no breach has been recorded on a device that had Lockdown Mode active.
Related: Robot to Extend Satellite Lifespan in Orbit
Experts say the alerts could spark broader investigations.
John Scott‑Railton, a senior researcher with the Citizen Lab digital‑rights group, first flagged the latest wave of alerts in a post on X. He called the push notification a “big improvement” over earlier alerts first rolled out in 2021, saying the messages give a clear signal that a community is under surveillance.
“Notifications create a critical signal that a community is being targeted. People get an alert, and then some of them reach out and seek help. Often this kicks off an investigation that reveals many, many more cases,” Scott‑Railton told TechCrunch.
He cited the ongoing Polish scandal, where former officials allegedly used spyware against political opponents, as an example of how the warnings can bring hidden abuse to light. Without the alerts, he argued, “that entire massive scandal about spyware abuse in the Polish election wouldn’t have been uncovered.”
For most recipients, the warning does not confirm that their device has been compromised, but it does indicate a credible risk. Users are urged to update their software, enable Lockdown Mode, and consider reaching out to trusted security professionals. The advice aligns with the firm’s broader push to strengthen its ecosystem against state‑level threats.
Related: WhatsApp tests folder for business messages
If a user ignores the alert, the spyware might continue to collect information or open backdoors for future attacks. Acting promptly—especially by enabling Lockdown Mode—adds layers of defense that make it far harder for malicious code to operate.
Apple’s approach reflects a growing trend among technology firms to directly inform customers about potential compromises. While such attacks remain relatively rare, the availability of advanced surveillance tools has increased the likelihood of misuse against journalists, activists and other high‑profile targets.
The messaging also emphasizes that the presence of a notification does not guarantee a successful intrusion. Nonetheless, the guidance to treat the alert seriously is consistent with best practices for device security.
As the push notifications roll out, the firm will monitor their impact and may adjust the guidance as new information emerges. For now, anyone who sees the message should follow the steps outlined on its support site and consider consulting a qualified expert if they have concerns about their device’s integrity.
