Apple sends out warnings to targets of mercenary spyware attacks

Apple

Apple periodically notifies users if its system has detected that they were targeted by a mercenary spyware attack. Well, it has just sent out a fresh round of warnings, as reported by John Scott-Railton, a senior researcher at University of Toronto's digital threat research center Citizen Lab. "That means tech like Pegasus used by governments to spy on you," Scott-Railton wrote in his post on X. 

ALERT: Did you get a notification like this today?

Seek expert security help asap!

Apple just sent out a fresh round of threat notifications about mercenary spyware.

That means tech like Pegasus used by governments to spy on you.

Here are steps to take right now 1/ pic.twitter.com/KFnZW3itFJ

— John Scott-Railton (@jsrailton) August 13, 2026

The iPhone-maker told TechCrunch that it has updated its user experience related to the warning and made it easier to access information. Its notification window tells the recipient that there are actions that they can take now to help protect their data and device. Apple has also published a new support page that details what mercenary spyware is and what someone can do if they had been targeted. 

Mercenary spyware are sophisticated surveillance tools that companies typically sell to state actors or governments, Apple explained in its page. They're then used to target certain individuals, like journalists, activists, politicians and diplomats. Mercenary spyware attacks cost millions of dollars, and are highly targeted. Most users will never be targeted by mercenary spyware, but they're also difficult to detect and prevent. 

Apple admitted that its investigations "can never achieve absolute certainty," but its notifications are "high-confidence alerts that a user has been individually targeted by a mercenary spyware attack, and should be taken very seriously." The company said it can't divulge how it determines who's under attack, because bad actors might use that information to evade detection in the future. 

Just because someone received the notification doesn't mean their data has already been compromised, but it does mean that Apple detected activity on their device consistent with a mercenary spyware attack. Apple advises recipients to enable Lockdown Mode to switch on extreme protection for their device. It blocks most message attachments, FaceTime calls, invitations for Apple services and shared photo albums. The company also advises enlisting expert help, specifically mentioning the Digital Security Helpline rapid-response emergency assistance offered by the nonprofit Access Now.