# Apple Expands On-Device Lock Screen Alerts for Mercenary Spyware Targets

> Apple has expanded its mercenary spyware threat-notification program to display high-confidence targeting alerts directly on iPhone Lock Screens and in Settings, supplementing the existing email, iMessage, and Apple Account page notifications. Apple sent the first Lock Screen-based alerts on August 13, 2026 to targets in 110 countries, part of a program that has now notified individuals in over 150 countries since it launched in 2021.

- **Published:** 2026-08-14T00:00:00Z
- **Last reviewed:** 2026-08-20T22:32:16.599Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2016
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-apple-mercenary-spyware-alerts-tl-2026-2016.webp?v=1a26abb8 (Threadlinqs threat intel: Apple Lock Screen Spyware Alerts: Analysis & Hunting (TL-2026-2016) — High severity, 28 IOCs, 9 detection rules.)
- **ID:** TL-2026-2016
- **Severity:** HIGH
- **Category:** THREAT_INTEL
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 28
- **CVEs:** CVE-2021-30860, CVE-2025-43200

## Description

Apple has for the first time delivered its mercenary spyware "threat notification" directly as a push alert on the iPhone Lock Screen and inside Settings (under "Apple Threat Notification"), rather than relying solely on email, iMessage, and an account.apple.com banner as it has since the program's 2021 launch. The August 13, 2026 round reached users in 110 countries; Apple says it has now notified individuals in over 150 countries in total since the program began. The alert text reads: "Apple detected a mercenary spyware attack targeted at your iPhone. There are actions you can take now to help protect your data and device." Apple describes these as high-confidence alerts based on its own internal threat-intelligence investigations and explicitly cites NSO Group's Pegasus as a historical example of the mercenary spyware class the program targets, while stating it does not attribute individual alerts to a specific spyware product or operator.

The program traces back to Apple's response to NSO Group's FORCEDENTRY exploit (CVE-2021-30860), a zero-click, zero-day iMessage exploit that abused an integer-overflow flaw in CoreGraphics/ImageIO JBIG2-encoded PDF processing to deliver Pegasus spyware without any user interaction, and which Citizen Lab captured on a Saudi activist's device in March 2021. Apple patched CVE-2021-30860 on September 13, 2021, and filed suit against NSO Group on November 23, 2021 seeking to permanently bar NSO from Apple's platform and devices; the threat-notification program dates to this same period. Apple's BlastDoor iMessage sandboxing mitigation (introduced in iOS 14) is understood to have driven NSO Group to develop FORCEDENTRY as a bypass after an earlier exploit (KISMET) was neutralized.

The underlying threat class is the commercial ("mercenary") spyware industry — vendors that develop and sell zero-click and one-click mobile intrusion capability to government customers, typically to surveil journalists, human-rights defenders, lawyers, political figures, diplomats, and civil-society organizers. Recent, publicly documented cases in this class include: (1) NSO Group's Pegasus used via the "PWNYOURHOME" zero-click exploit (crafted HomeKit NSKeyedArchive content processed by MessagesBlastDoorService) against former MEP Stelios Kouloglou on October 21, 2022 and again on March 6-7, 2023, while he served on the European Parliament's PEGA Committee investigating Pegasus abuse itself (Citizen Lab Report 194, published July 3, 2026); (2) Poland's ABW and SKW intelligence services' documented misuse of Pegasus against opposition figures, journalists, and prosecutors under the prior government (nearly 600 people targeted), which led to the December 2024 forced testimony of former ABW chief Piotr Pogonowski and the February 25, 2026 formal criminal charges against Pogonowski and former SKW chief Maciej Materka; (3) Paragon Solutions' Graphite spyware, delivered via a zero-click iMessage exploit (CVE-2025-43200, a logic flaw in processing a crafted photo/video shared via an iCloud Link, fixed across iOS/iPadOS/macOS/watchOS/visionOS on January-February 2025 patches), used against Italian journalists Francesco Cancellato and Ciro Pellegrino and activists Luca Casarini and Giuseppe Caccia in December 2024-February 2025, forensically confirmed by Citizen Lab on June 12, 2025 following an Apple threat notification on April 29, 2025; and (4) Intellexa Consortium's Predator spyware, whose developers and enablers (including Felix Bitzios, Andrea Gambazzi, Merom Harpaz, Panagiota Karaoli, Artemis Artemiou, and the BVI shell company Aliada Group Inc.) have been sanctioned multiple times by the US Treasury's Office of Foreign Assets Control for posing what Treasury called a significant threat to US national security.

Apple's stated primary mitigation for at-risk individuals is Lockdown Mode, an opt-in hardened configuration that aggressively restricts message attachments, complex web technologies (like just-in-time JavaScript compilation), unsolicited FaceTime calls, configuration profile installation, and wired connections when locked. Apple states it is not aware of any device with Lockdown Mode enabled having been successfully compromised by known mercenary spyware. Apple directs targeted individuals to Access Now's 24/7 Digital Security Helpline for free incident-response support and warns that phishing actors impersonate the legitimate threat-notification emails (sent from threat-notifications@email.apple.com) to harvest Apple ID credentials, so recipients should verify any alert by logging into account.apple.com directly rather than following links in the notification itself.

## MITRE ATT&CK

- T1456 Drive-By Compromise
- T1404 Exploitation for Privilege Escalation
- T1630 Indicator Removal on Host
- T1512 Video Capture
- T1429 Audio Capture
- T1430 Location Tracking
- T1636 Protected User Data
- T1481 Web Service
- T1646 Exfiltration Over C2 Channel
- T1588.006 Obtain Capabilities: Vulnerabilities
- T1583.001 Acquire Infrastructure: Domains
- T1190 Exploit Public-Facing Application
- T1566.001 Spearphishing Attachment
- T1189 Drive-by Compromise
- T1203 Exploitation for Client Execution
- T1547 Boot or Logon Autostart Execution
- T1036 Masquerading
- T1027 Obfuscated Files or Information
- T1480 Execution Guardrails
- T1056 Input Capture
- T1082 System Information Discovery
- T1057 Process Discovery
- T1113 Screen Capture
- T1115 Clipboard Data
- T1573 Encrypted Channel
- T1090 Proxy
- T1587.001 Develop Capabilities: Exploits

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Outbound Beacon to Known Mercenary-Spyware (Pegasus/Predator/Graphite) C2 Infrastructure** (`TL-2026-2016-SPL-003`)

Detects outbound network connections matched against threat-intel-enriched mercenary-spyware C2 infrastructure (NSO Group Pegasus, Intellexa Predator, Paragon Graphite command-and-control nodes and relay endpoints), indicating an active compromised device beaconing to spyware operator infrastructure via a legitimate-looking web service channel.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1481, T1646
- **Data sources:** proxy/web-gateway logs (Zscaler/Palo Alto), DNS resolver logs, threat-intel indicator feed (mercenary-spyware C2 IOC list)
- **Severity:** critical
- **Confidence:** high

### Splunk SPL

```spl
index=proxy OR index=dns sourcetype IN ("pan:threat","zscaler:web","stream:dns")
| lookup mercenary_spyware_c2_iocs.csv domain AS query OUTPUT malware_family, confidence
| where isnotnull(malware_family)
| stats count min(_time) as first_seen max(_time) as last_seen values(malware_family) as families by src_ip, dest_ip, query
| where count > 0
| sort -count
```

### Microsoft KQL

```kql
DeviceNetworkEvents
| where Timestamp > ago(24h)
| where RemoteUrl has_any ("cloudfront.net","fastly.net","akamaized.net")
| join kind=inner (
    ThreatIntelIndicators
    | where Description has_any ("Pegasus","Predator","Graphite","NSO Group","Intellexa","Paragon Solutions")
) on $left.RemoteIP == $right.NetworkIP
| project Timestamp, DeviceName, RemoteUrl, RemoteIP, Description
| summarize Count=count(), Devices=make_set(DeviceName) by RemoteUrl, RemoteIP, Description
```

### Sigma

```yaml
title: Outbound Beacon to Known Mercenary-Spyware C2 Infrastructure
id: 6a3f8d1c-5e2b-49a7-8f3d-2c9b6e4a1f83
status: experimental
description: Detects outbound network connections matched against threat-intel-enriched mercenary-spyware C2 infrastructure (Pegasus/Predator/Graphite).
references:
    - https://citizenlab.ca/research/member-of-committee-investigating-spyware-hacked-with-pegasus/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-08-14
tags:
    - attack.command-and-control
    - attack.t1481
    - attack.exfiltration
    - attack.t1646
logsource:
    category: proxy
detection:
    selection:
        ThreatIntelMatched: true
        ThreatIntelName|contains:
            - 'Pegasus'
            - 'Predator'
            - 'Graphite'
            - 'NSO Group'
            - 'Intellexa'
            - 'Paragon Solutions'
    condition: selection
falsepositives:
    - Threat-intel enrichment misclassification on shared CDN edge IPs; Pegasus/Predator infrastructure commonly rotates through legitimate cloud/CDN ranges — validate destination reputation before escalating
level: critical
```

**Known false positives:**

- Threat-intel enrichment misclassification on shared CDN edge IPs; validate destination reputation before escalating

**Tuning notes:** Keep the mercenary-spyware C2 IOC lookup table refreshed from Citizen Lab / Amnesty Security Lab published indicators; because operators rotate through shared CDN IP space, corroborate any hit with device-side forensic indicators (e.g. TL-2026-2016-KQL-002) before treating as confirmed compromise.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Lookalike Apple-ID Domain Click Following Threat-Notification-Themed Phishing Email (locked: unlock with TL Creds)
- iOS Forensic-Artifact Tampering Consistent with Mercenary-Spyware Cleanup (locked: unlock with TL Creds)
- High-Volume Data Transfer to Mercenary-Spyware C2 Relay (Exfiltration Over C2 Channel) (locked: unlock with TL Creds)
- Network Connection to Apple-ID Phishing-Kit Lookalike Domain (locked: unlock with TL Creds)
- Anomalous Sensitive-Permission Grant (Camera, Microphone, Location, Protected Data) to Unvetted Mobile App (locked: unlock with TL Creds)
- Domain-Fronted C2 via CDN Edge for Newly-Registered Mercenary-Spyware Domain (locked: unlock with TL Creds)
- Apple Threat-Notification Phishing Impersonation — Credential Harvesting Lure (locked: unlock with TL Creds)
- Unauthorized Mobile Configuration Profile Installation (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sources

- [Apple now uses iPhone alerts for targets of mercenary spyware](https://www.malwarebytes.com/blog/news/2026/08/apple-now-uses-iphone-alerts-for-targets-of-mercenary-spyware)
- [If Apple sends you a push notification alerting you to a spyware attack, take it seriously](https://techcrunch.com/2026/08/13/if-apple-sends-you-a-push-notification-alerting-you-to-a-spyware-attack-take-it-seriously/)
- [Apple sends new 'Threat Notification' alerts over mercenary spyware attacks](https://www.bleepingcomputer.com/news/apple/apple-sends-new-threat-notification-alerts-over-mercenary-spyware-attacks/)
- [Apple Sends Mercenary Spyware Attack Alerts to iPhone Users in 110 Countries](https://cybersecuritynews.com/apple-sends-spyware-attack-alerts/)
- [About Apple threat notifications and protecting against mercenary spyware](https://support.apple.com/en-us/102174)
- [FORCEDENTRY: NSO Group iMessage Zero-Click Exploit Captured in the Wild](https://citizenlab.ca/research/forcedentry-nso-group-imessage-zero-click-exploit-captured-in-the-wild/)
- [Espionage Against the European Parliament: Member of Committee Investigating Spyware Hacked with Pegasus (Report 194)](https://citizenlab.ca/research/member-of-committee-investigating-spyware-hacked-with-pegasus/)
- [Graphite Caught: First Forensic Confirmation of Paragon's iOS Mercenary Spyware Finds Journalists Targeted](https://citizenlab.ca/research/first-forensic-confirmation-of-paragons-ios-mercenary-spyware-finds-journalists-targeted/)
- [Poland charges ex-intel chiefs for using Israel's Pegasus spyware](https://www.aljazeera.com/news/2026/2/25/poland-charges-ex-intel-chiefs-for-using-israels-pegasus-spyware)
- [Poland arrests former spy chief in Pegasus spyware probe](https://techcrunch.com/2024/12/02/poland-arrests-former-spy-chief-in-pegasus-spyware-probe)
- [Italy: New case of journalist targeted with Graphite spyware confirms widespread use of unlawful surveillance](https://www.amnesty.org/en/latest/news/2025/06/italy-new-case-of-journalist-targeted-with-graphite-spyware-confirms-widespread-use-of-unlawful-surveillance/)
- [U.S. Treasury Sanctions Intellexa Spyware Amid Shifting Threat Landscape](https://www.secureworld.io/industry-news/us-treasury-sanctions-intellexa-spyware)
- [CVE-2025-43200: Apple iPadOS Logic Issue Vulnerability](https://www.sentinelone.com/vulnerability-database/cve-2025-43200/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2016