Apple sent a fresh round of threat notifications to iPhone users in 99 countries on Friday, October 30, 2026. Each alert tells the recipient that their Apple Account was individually targeted by mercenary spyware. It is the second Apple threat notification wave in about eleven weeks, and the company has not named the attacker, the spyware or the software flaw involved.
The timing matters for two reasons. The notices show that targeting continues, and they arrive while governments work through rules for the commercial hacking tools at the center of these cases. Coverage was still rising through Saturday, but the core facts have not changed since the notices went out.
What Apple's October 30 alerts actually say
The “99 countries” figure comes from the notification text itself. CyberScoop quoted the wording: “Today's notification is being sent to targeted users in 99 countries, and to date we have notified users in over 150 countries in total,” the company said. Apple has not issued a formal press release about the wave, so that sentence is the clearest official description available.
Recipients include journalists and documentary filmmakers, according to CyberScoop's reporting. Security researcher Costin Raiu reported the wave on October 30 and said it was separate from the August alerts and linked to new attacks. Cyber Security News also reported that Apple's alerts identify targeting with high confidence, but that this does not automatically establish that an attacker took control of every notified device.
Apple also declined to attribute the attacks. CyberScoop reported that Apple “does not attribute the attacks,” and the company has not tied them to a particular government, spyware developer or geographic region. BleepingComputer noted that Apple's guidance cites NSO Group's Pegasus as a historical example, and that forensic investigations into earlier notifications confirmed Pegasus infections in some cases. Apple uses Pegasus only as an illustration in this context. It does not attribute this wave to NSO Group or any other vendor.
How the new wave compares with earlier alerts
Apple has been sending these notifications several times a year since 2021, whenever it detects highly targeted mercenary spyware attacks. TechCrunch reported on a 98-country alert that followed an earlier 2024 wave, which reached users in 92 countries and was similarly unattributed. The table below puts the recent waves side by side.
| Wave | Countries | What stands out |
|---|---|---|
| 2024 wave | 92 | Unattributed, like the current round |
| Later 2024 wave | 98 | Followed the 92-country alert |
| August 13, 2026 | 110 | First wave to arrive as a Lock Screen push alert, not only email |
| October 30, 2026 | 99 | No recipient count or country list released |
The gap between waves is one of the more telling details. The August 13 notices were the largest of the recent set, and the October batch arrived about eleven weeks later. The August wave was also the first to appear as a Lock Screen push alert rather than only an email. That change matters because a push alert appears on a locked phone, while an email can sit unread for days.
Fewer countries than August does not mean fewer people. Apple has not disclosed how many individuals received the latest alerts, so the country count alone says little about the scale of the activity. Apple has said it has notified users in more than 150 countries in total since 2021, which gives the October figure some context but not a headcount.
Whether US iPhone users were among the notified
Readers cannot yet tell whether US iPhone users received the alerts, because Apple has not published a country list. The notices go to iPhone users with an Apple Account who have been singled out, and Apple says most users will never be targeted. BleepingComputer reported that targeted individuals tend to be journalists, activists, politicians and diplomats.
That profile explains why the alerts carry weight beyond a routine security advisory. An alert means someone has marked a specific person as a target. It also means the recipient may hold a sensitive role, which raises the stakes of any follow-up. Until Apple publishes more detail, the safest reading is that these alerts are rare, targeted and worth checking, not that every iPhone owner faces a threat.
How to tell a real Apple threat notification from a scam
Scammers copy urgent security warnings because people tend to act on them quickly, so verify before you click anything. HuffPost reported that the text is sent with the sender named “Apple Threat Notifications,” and that the email comes from [email protected] to the address associated with your Apple Account. The 420.in reported that Apple also shows a banner at account.apple.com after sign-in.
The safest check is to ignore any link in the message. Open a browser, type account.apple.com yourself, sign in, and look for the banner. Apple's alerts arrive through its own channels, so a link in an unexpected text or email is a reason for suspicion, not a path to confirmation.
What to do if you receive an alert
- Verify through Apple's own channels. Sign in at account.apple.com yourself, check for the banner, and do not reply to or click links in unexpected messages.
- Turn on Lockdown Mode. Apple recommends it for people facing these threats, and it limits certain features in exchange for a smaller attack surface.
- Ask for expert help. Notified users can contact Access Now's Digital Security Helpline for round-the-clock expert assistance, according to Apple's guidance as reported by Cyber Security News.
The reports reviewed for this story describe no patch, iOS update or software flaw tied to the October 30 wave. Keep your devices updated as you normally would, but there is no specific fix to install yet.
What comes next for spyware rules and attribution
The Pall Mall Process, a government-backed effort to set rules for commercial hacking tools, is nearing final negotiations, though its final guidelines are still under discussion. That gives this round of alerts more policy weight than a routine notice would carry. Natalia Krapiva, senior tech-legal counsel at Access Now, said, as quoted by CyberScoop, that “the fight against the scourge of spyware abuse is far from over.”
Three things are worth watching. First, whether Apple publishes a recipient count or a country list, which would answer the US question directly. Second, whether Apple names a spyware vendor, a delivery method or a software flaw, or keeps the wave unattributed as it did in earlier rounds. Third, whether Apple updates its threat notification support page, which still carries an August 13 publication date. Each answer would show how far this activity reaches and how it was carried out.
