Apple has sent a fresh round of threat notifications to users in 99 countries after detecting activity consistent with highly targeted mercenary spyware attacks. The recipients include journalists and documentary filmmakers, highlighting the continued risks faced by people whose work or public profile may make them targets of sophisticated surveillance operations.
The company said the latest notifications were sent on October 30, 2026. It added that it had notified users in more than 150 countries in total since it began issuing these warnings in 2021.
Apple has not disclosed how many individuals received the latest alerts or identified the countries involved. It also declined to attribute the suspected attacks to any particular government, spyware developer or geographical region.
Journalists And Civil Society Remain Potential Targets
Mercenary spyware refers to sophisticated surveillance software developed and sold by private companies, often to government customers. Such tools can be used to gain access to mobile phones and collect sensitive information, including messages, communications and other personal data.
Apple describes these operations as significantly more sophisticated than ordinary cybercrime. They are generally designed to target a small number of specific individuals rather than large groups of random users.
Journalists, activists, politicians and diplomats have historically been among those targeted. The latest notification round also includes journalists and documentary filmmakers, according to reporting on the alerts.
The surveillance industry has attracted international scrutiny because some commercial spyware products have been linked to alleged abuses against journalists, human rights defenders and political opponents. Pegasus, developed by NSO Group, is among the best-known examples of this market.
Apple has not named the spyware involved in the latest notifications. There is also no confirmation that every recipient’s device was successfully compromised.
What An Apple Threat Notification Actually Means
Apple says its threat notifications are high-confidence alerts based on its internal threat intelligence and investigations. They indicate that the company believes a user has been individually targeted by a mercenary spyware attack, although Apple acknowledges that its investigations cannot establish absolute certainty.
The notifications appear on the targeted person’s iPhone lock screen and in the Settings application. Apple also sends an email to addresses associated with the user’s Apple Account and displays a warning when the user signs in at account.apple.com.
The company does not reveal the technical indicators that trigger these alerts. It says disclosing that information could help spyware operators change their methods and avoid detection.
A notification should therefore be taken seriously, but it should not automatically be treated as forensic proof that spyware has successfully infected a device. Equally, the absence of an Apple warning does not establish that a device is free from surveillance software.
Apple has also warned users about fraudulent messages that imitate genuine threat notifications. A legitimate Apple alert will never ask recipients to click a link, install an application or configuration profile, or disclose their account password or verification code.
Pall Mall Process Moves Towards Industry Guidelines
The latest notification round comes as governments and industry representatives move closer to developing voluntary guidelines for companies involved in the commercial spyware market.
The initiative, known as the Pall Mall Process, was launched by the United Kingdom and France in 2024 to address the proliferation and irresponsible use of commercial cyber intrusion capabilities. It brings together governments, technology companies, researchers and civil society organisations.
In April 2025, 21 countries signed a voluntary Code of Practice for States, built around accountability, precision, transparency and oversight. The process subsequently shifted towards developing a separate set of expectations for companies that develop, sell, purchase or use commercial hacking tools.
Negotiations on the industry guidelines began in July 2026, with the guidelines expected to be finalised in November. The framework is voluntary, meaning its effectiveness will depend on whether participating companies and governments follow the commitments and whether meaningful accountability mechanisms emerge.
Digital rights organisations have called for stronger safeguards, arguing that voluntary commitments alone may not prevent the misuse of powerful surveillance technologies. Access Now has said that spyware continues to be used against civil society actors and opposition figures despite increased efforts by technology companies to identify and notify targets.
The timing of Apple’s latest alerts places the continuing spyware problem in focus as these international discussions approach their next stage. However, Apple has not said that the notifications are connected to the Pall Mall negotiations.
What This Means For Apple Users
People who receive an Apple threat notification should verify it directly rather than relying on links or instructions in an email or message. Apple advises signing in independently at account.apple.com, where a genuine notification will appear at the top of the account page.
The company recommends enabling Lockdown Mode, keeping devices updated and seeking expert assistance. It specifically points notified users towards Access Now’s Digital Security Helpline, which provides emergency support to people facing targeted digital threats.
The vast majority of Apple users will never be targeted by mercenary spyware. But the latest notifications show that sophisticated surveillance operations remain an international concern, particularly for people working in journalism, human rights and public-interest advocacy.
For governments and technology companies, the challenge is no longer limited to identifying spyware infections. It also involves making the commercial market behind these tools more transparent and ensuring that companies face meaningful consequences when their products are used for abuse.
