Apple’s Spyware Alerts Are Real — Here’s What To Do

Apple is now sending push notifications straight to iPhone lock screens, alerting users that they might be targets of mercenary spyware attacks. Security experts advise anyone receiving such a notification to treat it as an urgent matter.

Recently, the company issued a new round of these alerts to users in 110 countries, as reported by 9to5Mac. These notifications show up on your lock screen and come from Apple’s official threat notification system, which has been in place since 2021.

What Is Mercenary Spyware?

Mercenary spyware refers to commercial surveillance software sold by private companies to governments and state actors. Think of it as a hacking tool available for hire. The most notorious example is Pegasus, created by the Israeli firm NSO Group. Once this software is on your phone, it can read your messages, listen through your microphone, turn on your camera, and track your location—all without your knowledge. Unlike typical viruses, it’s designed to be stealthy.

These attacks are costly and technically challenging. That’s why they’re usually aimed at specific, high-value individuals: journalists, activists, politicians, diplomats, and business leaders. If Apple is flagging your device, it’s not just a random automated warning.

How Apple Determines If Your Device Is Targeted

Apple keeps an eye on its infrastructure for patterns that indicate a device is under threat. The company doesn’t share specific detection methods—revealing too much could help spyware developers evade detection. However, they state that these alerts rely on “threat intelligence signals” that reach a high confidence level before any notification is sent out.

According to TechCrunch, Apple now delivers these warnings directly to your lock screen instead of just through email, making them much harder to overlook.

Apple admits that false positives can occur, but they prefer to issue a warning unnecessarily rather than miss a real threat.

What To Do If You Receive One

If you see a notification on your lock screen from Apple indicating your device may be targeted by spyware, security researchers suggest the following actions:

• Don’t ignore it or brush it off as spam. This notification comes from Apple’s official system, not a third-party app.
• Enable Lockdown Mode right away. This iOS setting restricts your phone’s functionality to cut off common attack avenues. Go to Settings, then Privacy & Security, and then Lockdown Mode. Yes, it limits some features, but that’s the point.
• Reach out to a digital security organization. Groups like Access Now and Citizen Lab offer free assistance to individuals targeted by state-sponsored spyware. Apple’s notification includes contact info for these resources.
• Update your software. Many spyware attacks take advantage of known vulnerabilities. Keeping iOS updated helps close those gaps.
• Think about getting a new device. In severe cases, replacing your device may be necessary. If spyware has gained deep access, a factory reset might not suffice.

What This Means For Everyday Users

The truth is, most iPhone users will likely never see this notification, and that’s not false reassurance. Mercenary spyware costs tens or even hundreds of thousands of dollars to deploy. This software isn’t designed for mass surveillance of ordinary users.

However, there are two important reasons this matters, even if you’re not a journalist or activist. First, it shows that Apple actively uses its position in the ecosystem to safeguard users in ways that Android’s more open structure complicates. Second, it reminds us that our phones are, by design, surveillance devices—not because Apple intended it that way, but because they store so much of our lives, making them targets.

If you receive one of these alerts, the worst thing you can do is assume it’s a mistake and ignore it. Engadget confirmed that the latest wave of alerts is genuine and active.

Community Reactions

Online responses have ranged from concern to confusion about who might be targeted. One Reddit user in r/apple shared: “Got one of these last year. Contacted Access Now and they confirmed my device had indicators of Pegasus. I’m a journalist in Southeast Asia. This stuff is real.” (u/presspassPH)

Others were more skeptical about the scope. A YouTube commenter on a tech news video remarked: “People keep acting like this is going to happen to them. It won’t. But if it does, you’ll want to know what to do. Good on Apple for making it visible.” (@verifiedtech_watcher)

What To Watch

• Which countries were alerted: Apple hasn’t released the full list of the 110 countries included in this wave. Investigative reporting from groups like Citizen Lab may reveal patterns in the coming weeks.
• iOS 20 security features: The next major iOS release is expected to introduce further protections against zero-click exploits (attacks that require no user action to install spyware). Stay tuned for announcements this fall.
• NSO Group legal proceedings: Apple’s lawsuit against NSO Group is ongoing in U.S. courts. A ruling or settlement could influence how these tools are developed and sold worldwide.
• Lockdown Mode adoption data: Apple hasn’t disclosed how many users have enabled Lockdown Mode. If they start sharing that number, it’ll give insight into how seriously users are responding to these warnings.