# Apple threat notifications warn users in 99 countries of mercenary spyware attacks (October 2026 wave)

> On 30 October 2026 Apple sent threat notifications to targeted users in 99 countries about mercenary spyware attacks, bringing its cumulative total to over 150 countries since 2021. Recipients include journalists and documentary filmmakers; Apple does not attribute the attacks to specific actors or regions.

- **Published:** 2026-10-30T17:33:52Z
- **Last reviewed:** 2026-10-30T17:33:52Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4842
- **ID:** TL-2026-4842
- **Severity:** HIGH
- **Category:** THREAT_INTEL
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 11 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Apple confirmed on 30 October 2026 (CyberScoop, Tim Starks) that its latest threat-notification wave went to targeted users in 99 countries, and that "to date we have notified users in over 150 countries in total." The previous major batch was in August 2026, when Apple notified users in 110 countries (Apple statement to TechCrunch, 13 August 2026); search coverage also indicates a wave in 92 countries in April 2026. Recipients reported publicly include journalists and documentary filmmakers.

Apple describes mercenary spyware attacks as among the most advanced and costly digital threats, historically associated with state actors and private contractors working on their behalf, and typically aimed at a very small number of individuals such as journalists, activists, politicians and diplomats. Apple relies on internal threat-intelligence information to decide who is notified and deliberately does not disclose detection criteria, and it does not attribute the attacks to any specific attacker or region. The source material names no CVEs, spyware families, vendors, infrastructure or file/network indicators, so this record is a campaign-level awareness entry rather than a technical exploit analysis.

Notifications are delivered through three channels: a push alert on the iPhone Lock Screen and in Settings, an email to the address tied to the Apple Account (sender threat-notifications@email.apple.com), and a banner shown after signing in at account.apple.com. Apple states that genuine notifications never ask the user to click links, open files, install apps or profiles, or provide credentials; users should verify by signing in to account.apple.com directly. This also makes spoofed 'threat notification' messages a plausible phishing lure.

John Scott-Railton (The Citizen Lab) said the wave promises to be an important set of notifications with a number of cases, and recommends that recipients enable Lockdown Mode and contact Access Now's Digital Security Helpline; he also cautions against paid spyware-removal solutions. Natalia Krapiva (Access Now) said the volume of notifications worldwide indicates the fight against spyware abuse is far from over. In August 2026, researchers described the scale and geographic diversity of public posts about notifications as unprecedented.

On the policy side, the Pall Mall Process (launched by the UK and France in February 2024; a non-binding Code of Practice for States was adopted in April 2025 with 27 signatories) is nearing final negotiations on voluntary industry guidelines for commercial cyber intrusion capabilities, reportedly expected to be finalized in November 2026.

Technique mappings below are limited and are inferred from Apple's description of compromise of iPhones plus the attack surfaces that Lockdown Mode restricts (message attachments, complex web technologies, configuration profiles); the sources do not describe a specific exploit chain.

## MITRE ATT&CK

- T1664 Exploitation for Initial Access
- T1456 Drive-By Compromise
- T1660 Phishing
- T1404 Exploitation for Privilege Escalation
- T1636 Protected User Data

## Sources

- [Apple notifications alert victims in 99 countries about mercenary spyware infections (CyberScoop)](https://cyberscoop.com/apple-spyware-notifications-pall-mall-process/)
- [About Apple threat notifications and protecting against mercenary spyware (Apple Support)](https://support.apple.com/en-us/102174)
- [About Lockdown Mode (Apple Support)](https://support.apple.com/en-us/105120)
- [Apple Warns Users in 110 Countries of Mercenary Spyware (The Hacker News)](https://thehackernews.com/2026/08/apple-warns-users-in-110-countries-they.html)
- [Apple alerts iPhone users in 98 countries to mercenary spyware attacks (TechCrunch)](https://techcrunch.com/2024/07/10/apple-alerts-iphone-users-in-98-countries-to-mercenary-spyware-attacks)
- [Apple warning on mercenary spyware attacks (TechCrunch)](https://techcrunch.com/2024/04/10/apple-warning-mercenary-spyware-attacks/amp)
- [The Pall Mall Process Code of Practice for States (UK Government)](https://www.gov.uk/government/publications/the-pall-mall-process-code-of-practice-for-states)
- [Essential Elements for the Industry Guidelines on CCICs (Freedom House civil society submission)](https://freedomhouse.org/sites/default/files/2026-09/Essential_Elements_for_the_Industry_Guidelines_on_CCICs.pdf)
- [Voluntary Pall Mall Process seeks to curb spyware abuses (CyberScoop)](https://cyberscoop.com/voluntary-pall-mall-process-seeks-to-curb-spyware-abuses/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4842