Apple has issued a new wave of security notifications to people in 99 countries whom it believes were individually targeted by sophisticated mercenary spyware, raising fresh concerns about surveillance directed at journalists, activists and other prominent individuals.Cybersecurity researcher Costin Raiu disclosed the notifications on 30 October, saying they concerned new attacks and were separate from warnings distributed in August. The latest alerts do not establish that every recipient's device was successfully compromised, but indicate that Apple has identified activity consistent with targeted surveillance.
The notification text shared by Raiu states that Apple has now warned users in more than 150 countries since establishing its notification programme in 2021. The company has not publicly identified the 99 countries, the number of recipients or the spyware products suspected in this round. The absence of those details limits independent assessment of the campaign’s scale, the distribution of potential victims and whether the activity involved one surveillance operation or several unrelated attempts.
Apple's published guidance describes the warnings as high-confidence assessments based on its internal threat intelligence and investigations. It acknowledges that its findings cannot provide absolute certainty and says disclosure of the technical evidence behind individual alerts could help attackers evade future detection.
The latest distribution follows a separate round on 13 August, when Apple confirmed notifications reaching targeted users in 110 countries. The two figures refer to different batches and cannot be combined to determine the total number of countries affected or the number of individuals exposed.
The warnings concern commercially developed surveillance tools capable of exploiting weaknesses in smartphones to obtain sensitive information. Apple says these operations are unusually expensive and technically demanding, typically focusing on a limited number of people selected because of their work, public position or access to confidential communications.
Journalists and documentary filmmakers are among those who received the latest warnings. Apple identifies journalists, civil society activists, politicians and diplomats as groups historically exposed to such targeting, although membership of any profession does not by itself establish that an individual has been attacked.
John Scott-Railton, a senior researcher at the University of Toronto's Citizen Lab, said the volume of publicly visible alerts suggested an important new set of cases for investigators. He cautioned that people who had not received notifications should not assume their devices were necessarily free of spyware.
Natalia Krapiva, senior technology and legal counsel at digital rights organisation Access Now, said the geographical spread demonstrated the persistence of spyware abuse. She warned that powerful surveillance technologies continued to be used against civil society organisations and opposition figures despite improvements in detection and victim assistance.
Neither Apple nor the researchers have publicly connected the latest warnings to a named government, spyware supplier or specific software vulnerability. Apple says it does not attribute individual attacks to particular perpetrators or geographical regions. Consequently, the notices should not be treated as proof that any identified state or company directed this campaign.
Apple recommends that recipients activate Lockdown Mode, a protective setting that restricts certain device functions and reduces opportunities for sophisticated attackers. It also advises them to obtain specialist assistance rather than relying solely on ordinary antivirus checks or assumptions about whether their phones are functioning normally.
Access Now operates a round-the-clock Digital Security Helpline offering assistance to people facing serious digital threats. Specialist investigators can assess individual circumstances and advise on protective measures, although an Apple notification alone does not identify the precise infection mechanism or establish what information, if any, was accessed.
Recipients can check whether an alert is authentic by signing into their Apple Account directly. Genuine notifications appear prominently on the account page, while supported iPhones may display warnings on the Lock Screen and within Settings. Apple also sends notifications to email addresses associated with the account.
The company stresses that genuine messages never demand passwords or verification codes, ask recipients to install applications or configuration profiles, or instruct them to open attachments. These safeguards matter because criminals can imitate security warnings to trick users into disclosing credentials or installing malicious software.
For users who have not received an alert, Apple's general recommendations include keeping operating systems updated, using strong account protection and avoiding unfamiliar attachments. Lockdown Mode remains available to people who believe their circumstances place them at unusually high risk of targeted surveillance, even without receiving an alert.
Topics
Technology