Apple has pushed out another wave of mercenary spyware warnings, this time reaching targeted iPhone users in 99 countries. Security researcher Costin Raiu surfaced the notification on October 30, 2026, noting that it is a distinct wave from the alerts Apple issued back in August and is tied to a fresh set of attacks rather than a continuation of the earlier campaign.

What Apple’s Notice Actually Says

According to the text shared by Raiu, Apple told affected users: “Today’s notification is being sent to targeted users in 99 countries, and to date we have notified users in over 150 countries in total.” That single line does a lot of work. It confirms the scale of Apple’s ongoing threat-notification program while being careful not to attribute the activity to any particular government, vendor, or spyware family.

Apple has not named an attacker, a targeted region, or the specific spyware tool behind this round of alerts. That reticence is deliberate. The company has long argued that revealing detection methods would hand attackers a roadmap for evading detection the next time around, so it limits disclosures to the fact that targeting occurred and basic guidance on what recipients should do next.

Who Gets Targeted and Why

Apple’s own threat-notification guidance frames mercenary spyware as a fundamentally different threat from the mass-market phishing and malware that most users encounter. These operations:

• Are built and deployed against a small number of hand-picked individuals rather than broad populations
• Can cost attackers millions of dollars to develop, license, or operate per target
• Disproportionately focus on journalists, human rights defenders, politicians, diplomats, and dissidents
• Rely on short operational windows and high technical sophistication, making them difficult to catch in the act

Because of that cost and selectivity, a notification does not mean a device was definitely compromised — it means Apple has high confidence that the account or device was targeted. The company is explicit that targeting and successful infection are not the same thing, and it avoids overstating what its telemetry can prove.

How the Warnings Reach Users

Apple delivers these alerts through several channels simultaneously: a lock-screen notification, a banner inside the Settings app, and an email sent to the address tied to the recipient’s Apple Account. A corresponding banner also appears once the user signs back into their account online, and exactly which channels fire can vary depending on the device model and iOS version in use.

That multi-channel approach exists partly as a defense against impersonation. Apple is unambiguous that a genuine threat notification will never ask a recipient to install an app or configuration profile, open an attached file, or hand over a password or verification code. Anyone who receives a message claiming to be from Apple that makes those requests should treat it as a phishing attempt rather than a real security warning, and should verify any notification by logging into Apple’s account portal directly rather than clicking through a link.

A Pattern That Keeps Repeating

This is not an isolated event. Apple’s August wave alone covered users in 110 countries, and the cumulative total — users notified across more than 150 countries since the program began — illustrates just how global the mercenary spyware market has become. Commercial surveillance vendors continue to sell intrusion capability to a wide range of government customers, and Apple’s recurring alerts are effectively the most visible public signal of how active that market remains.

While Apple’s guidance references Pegasus-style tools as historical examples of mercenary spyware, it stops short of attributing this specific wave to any named product. Readers should be cautious about reporting that claims a specific spyware family is responsible here unless Apple or an independent research lab, such as Citizen Lab or Amnesty International’s Security Lab, publishes that attribution with supporting technical evidence.

What to Do If You’re Notified

Security researchers recommend that anyone who receives one of these notifications take several concrete steps rather than dismissing it as background noise:

• Verify the alert by logging into appleid.apple.com directly, not through any link sent in a message
• Update iOS to the latest available version immediately
• Enable Lockdown Mode if there is any realistic concern about being a high-value target
• Reach out to a digital-safety organization, such as Access Now’s Digital Security Helpline, for individualized guidance
• Avoid installing unfamiliar configuration profiles or granting unusual permission requests in the days following a notification

For most iPhone owners, these notifications will never arrive. But for the specific slice of the population that mercenary spyware operators consider valuable — often because of their work, advocacy, or public role — Apple’s warnings remain one of the few concrete signals that the threat is real, active, and still expanding in scope.