# Apple Sends Mercenary Spyware Alerts to iPhone Users in 99 Countries

- URL: https://usa-24.com/apple-threat-notification-99-countries/
- Publisher: USA 24
- Section: Cybersecurity
- Published: 2026-10-31T18:25:07.141Z
- Updated: 2026-10-31T18:25:07.150Z
- Topics: Apple, Mercenary Spyware, iPhone Security, Data Privacy, Spyware Policy

> Apple's new threat notification wave reached iPhone users in 99 countries on October 30. The company has not named the spyware, the attacker or how many people were alerted.

## Key takeaways

- Apple sent threat notifications to iPhone users in 99 countries on Friday, October 30, 2026, its second wave in about eleven weeks after the August 13 wave that covered 110 countries.
- Apple has not disclosed how many people received the alerts, which countries were included, or whether US iPhone users were notified.
- Apple does not attribute the attacks and has not named a spyware product, delivery method or software flaw behind this wave.
- Genuine alerts come by text from a sender named Apple Threat Notifications and by email from threat-notifications@email.apple.com, and a banner appears at account.apple.com after sign-in.
- Apple recommends Lockdown Mode for people facing these threats, and Access Now's Digital Security Helpline offers round-the-clock expert assistance to notified users.

Apple sent a fresh round of threat notifications to iPhone users in 99 countries on Friday, October 30, 2026. Each alert tells the recipient that their Apple Account was individually targeted by mercenary spyware. It is the second Apple threat notification wave in about eleven weeks, and the company has not named the attacker, the spyware or the software flaw involved.

The timing matters for two reasons. The notices show that targeting continues, and they arrive while governments work through rules for the commercial hacking tools at the center of these cases. Coverage was still rising through Saturday, but the core facts have not changed since the notices went out.

## What Apple's October 30 alerts actually say

The “99 countries” figure comes from the notification text itself. [CyberScoop](https://cyberscoop.com/apple-spyware-notifications-pall-mall-process/) quoted the wording: “Today's notification is being sent to targeted users in 99 countries, and to date we have notified users in over 150 countries in total,” the company said. Apple has not issued a formal press release about the wave, so that sentence is the clearest official description available.

Recipients include journalists and documentary filmmakers, according to CyberScoop's reporting. Security researcher Costin Raiu reported the wave on October 30 and said it was separate from the August alerts and linked to new attacks. [Cyber Security News](https://cybersecuritynews.com/apple-warns-iphone-users/) also reported that Apple's alerts identify targeting with high confidence, but that this does not automatically establish that an attacker took control of every notified device.

Apple also declined to attribute the attacks. CyberScoop reported that Apple “does not attribute the attacks,” and the company has not tied them to a particular government, spyware developer or geographic region. [BleepingComputer](https://www.bleepingcomputer.com/news/apple/apple-sends-new-threat-notification-alerts-over-mercenary-spyware-attacks/) noted that Apple's guidance cites NSO Group's Pegasus as a historical example, and that forensic investigations into earlier notifications confirmed Pegasus infections in some cases. Apple uses Pegasus only as an illustration in this context. It does not attribute this wave to NSO Group or any other vendor.

## How the new wave compares with earlier alerts

Apple has been sending these notifications several times a year since 2021, whenever it detects highly targeted mercenary spyware attacks. [TechCrunch](https://techcrunch.com/?p=2807429) reported on a 98-country alert that followed an earlier 2024 wave, which reached users in 92 countries and was similarly unattributed. The table below puts the recent waves side by side.

| Wave | Countries | What stands out |
|---|---|---|
| 2024 wave | 92 | Unattributed, like the current round |
| Later 2024 wave | 98 | Followed the 92-country alert |
| August 13, 2026 | 110 | First wave to arrive as a Lock Screen push alert, not only email |
| October 30, 2026 | 99 | No recipient count or country list released |

The gap between waves is one of the more telling details. The August 13 notices were the largest of the recent set, and the October batch arrived about eleven weeks later. The August wave was also the first to appear as a Lock Screen push alert rather than only an email. That change matters because a push alert appears on a locked phone, while an email can sit unread for days.

Fewer countries than August does not mean fewer people. Apple has not disclosed how many individuals received the latest alerts, so the country count alone says little about the scale of the activity. Apple has said it has notified users in more than 150 countries in total since 2021, which gives the October figure some context but not a headcount.

## Whether US iPhone users were among the notified

Readers cannot yet tell whether US iPhone users received the alerts, because Apple has not published a country list. The notices go to iPhone users with an Apple Account who have been singled out, and Apple says most users will never be targeted. BleepingComputer reported that targeted individuals tend to be journalists, activists, politicians and diplomats.

That profile explains why the alerts carry weight beyond a routine security advisory. An alert means someone has marked a specific person as a target. It also means the recipient may hold a sensitive role, which raises the stakes of any follow-up. Until Apple publishes more detail, the safest reading is that these alerts are rare, targeted and worth checking, not that every iPhone owner faces a threat.

## How to tell a real Apple threat notification from a scam

Scammers copy urgent security warnings because people tend to act on them quickly, so verify before you click anything. [HuffPost](https://www.huffpost.com/entry/mercenary-spyware-is-attacking-apple-users-in-hundreds-of-countries-heres-how-to-know-if-youre-a-target-g_l_6aaaaef0e4b0288deb0e3480) reported that the text is sent with the sender named “Apple Threat Notifications,” and that the email comes from threat-notifications@email.apple.com to the address associated with your Apple Account. [The 420.in](https://the420.in/cyber-crime/apple-sends-spyware-threat-alerts-to-targeted-users-across-99-countries/) reported that Apple also shows a banner at account.apple.com after sign-in.

The safest check is to ignore any link in the message. Open a browser, type account.apple.com yourself, sign in, and look for the banner. Apple's alerts arrive through its own channels, so a link in an unexpected text or email is a reason for suspicion, not a path to confirmation.

## What to do if you receive an alert

1. Verify through Apple's own channels. Sign in at account.apple.com yourself, check for the banner, and do not reply to or click links in unexpected messages.
2. Turn on Lockdown Mode. Apple recommends it for people facing these threats, and it limits certain features in exchange for a smaller attack surface.
3. Ask for expert help. Notified users can contact Access Now's Digital Security Helpline for round-the-clock expert assistance, according to Apple's guidance as reported by Cyber Security News.

The reports reviewed for this story describe no patch, iOS update or software flaw tied to the October 30 wave. Keep your devices updated as you normally would, but there is no specific fix to install yet.

## What comes next for spyware rules and attribution

The Pall Mall Process, a government-backed effort to set rules for commercial hacking tools, is nearing final negotiations, though its final guidelines are still under discussion. That gives this round of alerts more policy weight than a routine notice would carry. Natalia Krapiva, senior tech-legal counsel at Access Now, said, as quoted by CyberScoop, that “the fight against the scourge of spyware abuse is far from over.”

Three things are worth watching. First, whether Apple publishes a recipient count or a country list, which would answer the US question directly. Second, whether Apple names a spyware vendor, a delivery method or a software flaw, or keeps the wave unattributed as it did in earlier rounds. Third, whether Apple updates its threat notification support page, which still carries an August 13 publication date. Each answer would show how far this activity reaches and how it was carried out.

## Frequently asked questions

### Does an Apple threat notification mean my iPhone has been hacked?

Not necessarily. Apple says its alerts identify targeting with high confidence, but they do not automatically establish that an attacker took control of every notified device. Apple also says most users will never be targeted, so the alert is a warning that you were singled out rather than confirmation of an infection.

### How can I tell if an Apple threat notification is real or a scam?

A genuine alert arrives by text from a sender named Apple Threat Notifications and by email from threat-notifications@email.apple.com to the address on your Apple Account. Apple also shows a banner at account.apple.com after you sign in. Type that address yourself instead of clicking links in unexpected messages.

### Which countries received the October 30, 2026 alert?

Apple has not published a list of countries. It has said only that the notice went to targeted users in 99 countries, so whether US iPhone users were included remains unconfirmed. Apple has also not disclosed how many people received the alerts.

### Should I turn on Lockdown Mode after getting an alert?

Apple recommends Lockdown Mode for people facing these threats, and reporting describes targeted individuals as often including journalists, activists, politicians and diplomats. Lockdown Mode limits certain features to reduce the attack surface. Notified users can also contact Access Now's Digital Security Helpline for expert help.

### Which spyware did Apple say was behind the attacks?

Apple has not named a spyware vendor, delivery method or software flaw for this wave. Its guidance mentions NSO Group's Pegasus only as a historical example, and Apple does not attribute the current attacks to it or to any government.

## Sources

1. [Apple notifications alert victims in 99 countries about mercenary spyware infections — CyberScoop](https://cyberscoop.com/apple-spyware-notifications-pall-mall-process/)
2. [Apple Warns iPhone Users in 99 Countries of Sophisticated Mercenary Spyware Attacks — Cyber Security News](https://cybersecuritynews.com/apple-warns-iphone-users/)
3. [Apple sends new 'Threat Notification' alerts over mercenary spyware attacks — BleepingComputer](https://www.bleepingcomputer.com/news/apple/apple-sends-new-threat-notification-alerts-over-mercenary-spyware-attacks/)
4. [Apple warns iPhone users in 98 countries of spyware attacks — TechCrunch](https://techcrunch.com/?p=2807429)
5. [Mercenary Spyware Is Attacking Apple Users In Hundreds Of Countries — HuffPost](https://www.huffpost.com/entry/mercenary-spyware-is-attacking-apple-users-in-hundreds-of-countries-heres-how-to-know-if-youre-a-target-g_l_6aaaaef0e4b0288deb0e3480)
6. [Apple Sends Spyware Threat Alerts To Targeted Users Across 99 Countries — The 420.in](https://the420.in/cyber-crime/apple-sends-spyware-threat-alerts-to-targeted-users-across-99-countries/)