# Apple Mercenary-Spyware Threat Notification Wave Reaches Users in 110 Countries (Citizen Lab: 'Pretty Unprecedented')

> On 2026-08-13 Apple sent a new batch of high-confidence 'mercenary spyware' threat notifications to iPhone users in 110 countries; Citizen Lab's John Scott-Railton called the scale and geographic diversity of public reports 'pretty unprecedented'. No spyware family, CVE, IOC or attributed actor has been disclosed for this wave.

- **Published:** 2026-10-15T10:10:36Z
- **Last reviewed:** 2026-10-15T10:10:36Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3605
- **ID:** TL-2026-3605
- **Severity:** HIGH
- **Category:** THREAT_INTEL
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 10 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Apple sent a new wave of Threat Notifications on 2026-08-13 to users it assessed as individually targeted by mercenary spyware, covering users in 110 countries. Apple states it has now notified users in more than 150 countries since the programme began in late 2021 (expanded in April 2024). Notifications are delivered through three channels: an iPhone lock-screen alert, an email from threat-notifications@email.apple.com, and a banner at the top of account.apple.com after sign-in. The wording reported by TechCrunch is: 'Apple detected a mercenary spyware attack targeted at your iPhone. There are actions you can take now to protect your data and device.'

Apple describes these as high-confidence alerts that a user was singled out because of who they are or what they do. Typical recipients are journalists, activists, politicians and diplomats; reporting also notes some Ukrainian military members among recipients and record contact volumes at human-rights support organisations. Apple deliberately does not attribute attacks to a specific vendor, actor or region, and the notifications name no spyware family. NSO Group's Pegasus is cited by Apple only as an example of mercenary spyware, and forensic investigations have confirmed Pegasus infections in some past cases; this is context, not a finding for this wave.

Citizen Lab (2026-08-20) states that the scale and geographic diversity of public posts about receiving notifications are 'pretty unprecedented', and that for each public report there is likely a large 'notification iceberg'. TechCrunch cites Poland's government spyware scandal as one that was uncovered in part through Apple's alerts. Apple says it has yet to see a case of a device compromised while Lockdown Mode was enabled.

No CVE, exploit chain, delivery vector, C2 infrastructure, malware hash or attribution is stated in any retrieved source. This record is therefore a campaign-level signal. The ATT&CK mobile mappings are generic and inferred from the mercenary-spyware class, not from evidence specific to this wave. Defenders should treat the only technical artefacts as the legitimate notification channels, which are useful for verifying authenticity and for spotting phishing that impersonates them. Guidance: update iOS, enable Lockdown Mode, use a passcode/biometrics, 2FA and Stolen Device Protection, install apps only from trusted sources, avoid unexpected links/attachments, verify the alert at account.apple.com, and seek expert forensic help (e.g. Access Now Digital Security Helpline, Citizen Lab) if notified.

## MITRE ATT&CK

- T1664 Exploitation for Initial Access
- T1660 Phishing
- T1658 Exploitation for Client Execution
- T1404 Exploitation for Privilege Escalation
- T1636 Protected User Data
- T1429 Audio Capture
- T1430 Location Tracking

## Sources

- ['Unprecedented' Number of Apple Users Received Recent Spyware Alert](https://citizenlab.ca/unprecedented-number-of-apple-users-received-recent-spyware-alert/)
- [Apple Warns Users in 110 Countries They May Be Targets of Mercenary Spyware](https://thehackernews.com/2026/08/apple-warns-users-in-110-countries-they.html)
- [If Apple sends you a push notification alerting you to a spyware attack, take it seriously](https://techcrunch.com/2026/08/13/if-apple-sends-you-a-push-notification-alerting-you-to-a-spyware-attack-take-it-seriously/)
- [Apple sends new 'Threat Notification' alerts over mercenary spyware attacks](https://www.bleepingcomputer.com/news/apple/apple-sends-new-threat-notification-alerts-over-mercenary-spyware-attacks/)
- [Apple sends fresh wave of mercenary spyware warnings worldwide](https://9to5mac.com/2026/08/13/apple-sends-fresh-wave-of-mercenary-spyware-warnings-worldwide/)
- [Apple Threat Notification Sent to Users in 110 Countries](https://petapixel.com/2026/08/14/apple-threat-notifcation-sent-to-users-in-110-countries/)
- [About Apple threat notifications and protecting against mercenary spyware](https://support.apple.com/en-us/102174)
- [Apple warns of mercenary spyware attacks (April 2024 expansion)](https://techcrunch.com/2024/04/10/apple-warning-mercenary-spyware-attacks/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3605