Apple has issued a fresh round of threat notifications to users in 110 countries, warning that their devices may have been individually targeted by highly sophisticated mercenary spyware. The latest alerts were sent on August 13, 2026, and have renewed concerns among iPhone, iPad and Mac users about the growing threat posed by advanced surveillance tools.

The notifications are not routine security warnings or general alerts sent to all Apple customers. Instead, they are targeted communications issued when the company believes there is a high-confidence possibility that a particular individual has been deliberately targeted because of their identity, profession, activities or other circumstances.

Apple has confirmed that the latest round of notifications was sent to users across 110 countries, although it has not publicly identified the affected countries or disclosed the number of recipients. The company has previously said that its threat notifications are based on internal threat intelligence and investigations into sophisticated attacks.

Why are Apple users receiving threat notifications?

The purpose of an Apple threat notification is to warn a user that their device may have been targeted by mercenary spyware.

Mercenary spyware refers to highly advanced surveillance software developed and deployed by private companies or specialised operators. Such tools are generally far more sophisticated than ordinary malware and may be used to secretly gain access to a targeted person’s device and information.

Unlike common cyberattacks that typically attempt to compromise large numbers of people, mercenary spyware operations are usually highly selective. Attackers may focus on a small number of specific individuals and invest significant financial and technical resources in attempting to compromise their devices.

Apple describes these attacks as among the most sophisticated digital threats facing users because attackers can use advanced techniques to bypass conventional security protections.

The company has also stressed that its notifications are intended to help people who may be individually targeted rather than warn the wider public about a conventional cyberattack.

Who is most likely to receive the alert?

Apple does not publish a fixed list of people who will receive threat notifications. However, individuals whose work or public activities could make them attractive targets for sophisticated surveillance operations may face a greater risk.

Potentially vulnerable groups can include journalists, activists, political figures, diplomats, government officials, researchers, lawyers and other people involved in sensitive or high-profile activities.

Being part of one of these groups does not automatically mean that someone will receive an alert. The notification is based on Apple’s assessment of a specific potential targeting incident.

Similarly, receiving a notification does not necessarily mean that Apple has conclusively established that a device has been compromised. Rather, the company considers the warning a high-confidence indication that an individual may have been targeted and advises the recipient to take it seriously.

What makes mercenary spyware different from ordinary malware?

The difference largely lies in the sophistication and intended targets of the attack.

Ordinary malware campaigns can involve phishing emails, malicious applications, fraudulent websites or other methods designed to compromise large numbers of devices. Mercenary spyware, by contrast, can involve extensive resources and sophisticated technical capabilities directed at particular individuals.

Attackers may attempt to exploit previously unknown vulnerabilities, manipulate users into interacting with malicious content or use highly specialised techniques to gain access to protected information.

Once installed or successfully deployed, advanced spyware can potentially expose sensitive information stored on a device. Depending on the spyware and the nature of the compromise, attackers may seek access to communications, files, accounts, contacts, location information or other personal data.

The highly targeted nature of these operations makes them particularly difficult to detect using conventional security practices alone.

Does receiving the notification mean the iPhone has definitely been hacked?

Not necessarily.

An Apple threat notification should be treated as a serious warning, but it should not automatically be interpreted as definitive proof that a device has been completely compromised.

Apple has said its investigations cannot provide absolute certainty. However, the company considers the alerts to be high-confidence warnings based on its threat intelligence and analysis.

This distinction is important because sophisticated attacks can be difficult to confirm conclusively. A warning may indicate that Apple has detected evidence suggesting an individual was targeted, even when it cannot establish every detail about the attempted or suspected compromise.

Users who receive such an alert should therefore avoid dismissing it as ordinary spam or a generic security message.

Why does Apple send these alerts?

Apple began issuing threat notifications in 2021 as part of its effort to inform people who may be targeted by advanced spyware.

The company has sent such warnings periodically as its security teams identify suspected targeting activity. The latest campaign represents another expansion of the notification programme, with warnings reaching users in 110 countries.

Apple has previously said that these attacks can originate from highly resourced operators and that the company does not necessarily attribute every notification to a particular attacker or geographical region.

This approach reflects the difficulty of identifying the individuals or organisations behind sophisticated spyware campaigns. Attribution can require extensive technical investigation and intelligence gathering, and Apple has indicated that it does not automatically connect a notification with a particular government or country.

What should users do after receiving an Apple threat notification?

Anyone who receives the warning should take several immediate security precautions.

The first step is to carefully follow Apple’s security recommendations and ensure that the device is running the latest available operating-system version. Software updates frequently include security fixes that address vulnerabilities that could otherwise be exploited.

Users should also review their accounts and devices for unusual activity and consider strengthening account security, including the use of strong passwords and multi-factor authentication where available.

People at elevated risk should exercise additional caution when opening unexpected messages, clicking links, downloading files or installing applications. Sophisticated attacks can sometimes rely on social engineering as well as technical vulnerabilities.

If the person receiving the alert works in a sensitive profession, they may also want to seek assistance from a trusted cybersecurity professional or organisation experienced in responding to targeted spyware threats.

Apple has warned users before

The latest notifications are not the first time Apple has warned customers about mercenary spyware.

The company has repeatedly used threat notifications when its security teams identify activity suggesting that specific users could be targeted. Previous notifications have attracted international attention because of the implications for journalists, political figures, activists and other individuals whose work can make them targets for surveillance.

The recurring alerts also highlight an increasingly important reality of modern digital security: having a secure consumer device does not completely eliminate the possibility of sophisticated attacks.

Apple’s security systems are designed to make attacks more difficult, but highly resourced attackers can continue to search for vulnerabilities and develop new techniques.

Why the latest warning matters

The latest round of notifications illustrates the increasingly global nature of advanced cyber threats.

Apple said the new alerts were sent to users in 110 countries, while the company has issued notifications to customers in more than 150 countries since beginning the programme. The geographical reach demonstrates that targeted spyware is not limited to one particular region or a small group of users.

At the same time, the relatively selective nature of the notifications means that the majority of Apple customers are unlikely to receive one.

For ordinary users, the warning is nevertheless a reminder of the importance of keeping devices updated, protecting accounts and remaining cautious about suspicious communications.

For people whose professional or public activities make them potential targets, the alert carries much greater significance. A notification should prompt a careful review of digital security practices rather than being treated as an ordinary software message.

The larger cybersecurity concern

The emergence of mercenary spyware has raised broader questions about privacy, surveillance and the security of modern digital communications.

Smartphones now contain enormous amounts of personal and professional information, from private conversations and photographs to financial records, documents and location data. A successful compromise can therefore provide attackers with access to a highly detailed picture of an individual’s life.

The growing sophistication of spyware has also made cybersecurity increasingly important for people who handle sensitive information. Journalists, researchers, lawyers, activists and public officials may face particular risks because compromising their devices can expose confidential communications and information involving other people.

Apple’s threat notification system is designed to give potential victims an early warning so that they can take protective measures.

For those who receive the latest alert, the message is therefore more than a routine security notification. It is an indication that Apple believes the individual may have been specifically targeted by an unusually sophisticated cyber operation.

The company has urged recipients to take such warnings seriously and follow recommended security measures. For users who have not received an alert, the development nevertheless serves as a reminder that advanced cyber threats continue to evolve alongside the technology designed to prevent them.