Asl matn EN tilida, manba saytidan olindi. Manba ↗

Apple has started sending a new round of threat notifications to users across 99 countries, warning them about targeted mercenary spyware attacks, according to cybersecurity researcher Costin Raiu. In his post, Raiu noted that these notifications are related to new attacks and are separate from the wave of alerts sent out in August.

The notification quoted by Raiu states: “Today’s notification is being sent to targeted users in 99 countries, and to date, we have notified users in over 150 countries in total.”

Apple’s published guidance confirms the overall reach of its notification program, which has operated since 2021. However, the support document does not specify the distribution related to the newly reported 99 countries.

Apple describes these notifications as high-confidence warnings that an individual has been targeted by mercenary spyware. They should be taken seriously, but receiving an alert does not establish that attackers successfully compromised the device. Apple acknowledges that its investigations cannot achieve absolute certainty.

The company relies on internal threat intelligence and investigations to identify suspicious activity. Its mercenary spyware warnings concern highly selective surveillance operations rather than indiscriminate malware distribution, with targets potentially selected because of their identity or professional activities.

The new notifications follow alerts issued across 110 countries in August. Those figures describe separate notification rounds, not necessarily different victim populations. They should not be added together to calculate unique affected countries.

The quoted notice does not identify a spyware vendor, exploited vulnerability, delivery mechanism, or responsible government. Apple explicitly avoids attributing these attacks or notifications to particular attackers or geographic regions.

Comparable investigations illustrate the technical risks without identifying this wave’s attackers. Researchers examining Graphite spyware attacks against journalists documented an iMessage zero-click exploit involving CVE-2025-43200. That separate case required no user interaction and was addressed through an iOS security update. No evidence supplied here connects Graphite to the latest notifications.

Recipients should verify alerts by manually signing into their Apple Account, where a notification banner appears. Apple also delivers warnings through email and directly on supported iPhones. Heads-up: New round of Apple Threat Notifications is going out right now, distinct from the August wave and tied to new attacks!

Apple’s notice:

“Today’s notification is being sent to targeted users in 99 countries, and to date we have notified users in over 150 countries in… pic.twitter.com/sBEA3VTFHl

— Costin Raiu (@craiu) October 30, 2026

Apple’s official protection guidance recommends enabling Lockdown Mode and seeking specialist assistance, including Access Now’s Digital Security Helpline, available around the clock.

Authentic notifications never request passwords, verification codes, application installations, configuration profiles, or file downloads. Treat any such request as suspicious rather than following it as part of Apple’s warning process.

Give your SOC the alert context to stops incidents quickly.Integrate Threat Intel from 16K SOCs.