Apple has issued a new round of security threat notifications to iPhone owners across 99 countries worldwide. Users received warnings stating that they have been targeted by a new type of cyberattack utilizing mercenary spyware. Cybersecurity researcher Costin Raiu reported this wave of notifications, emphasizing that the current alerts differ from previous warnings sent by the company back in August 2026.
A Separate Wave of Attacks: What Is Known About the Scale
According to data shared by Raiu in his post, Apple states that the notifications are being sent to "targeted users in 99 countries, and to date, the company has notified users in over 150 countries combined." The researcher notes that this wave of attacks is separate from the August one and is associated with new attacks. Meanwhile, Apple has not claimed specific attacks or indicated which threat groups or geographic regions are behind them.
Apple's Stance: Numbers Do Not Equal Confirmed Infections
Representatives from the Cupertino-based company clarify that the figures reflect only the geographic locations of users who received the notification. They do not represent the exact number of confirmed infections or successfully compromised devices. Apple intentionally refrains from disclosing details of its detection systems to prevent spyware developers from adapting their programs to circumvent defense mechanisms. Company notifications appear directly on the iPhone lock screen, within device settings, and are also sent to the email address associated with the Apple ID.
Why Such Attacks Are Difficult to Detect
According to security experts, such cyberattacks "require colossal resources and are aimed at a narrow circle of individuals." Creating and executing spyware campaigns of this magnitude costs millions of dollars, which is why regular users are rarely targeted. The key difficulty in detection lies in the use of unique, short-lived tools: attackers develop specialized software that quickly becomes obsolete and is replaced by new variants, rendering traditional signature-based defense methods ineffective.
How to Check Notifications and Secure Your Device
Experts recommend checking for notifications through your official user account. Genuine messages from Apple never require the installation of third-party files, applications, or entering passwords. To protect against sophisticated attacks, users should regularly update their operating systems, avoid installing apps from unverified sources, and remain vigilant regarding any credential requests supposedly originating from Apple.
The current situation confirms a steady trend toward an increase in targeted spyware campaigns aimed at premium mobile device owners. Apple continues to operate in proactive defense mode, alerting users before attackers can complete the vulnerability exploitation cycle.
