Apple warns users in 99 countries of mercenary spyware
Apple sent a fresh round of threat notifications to suspected mercenary-spyware targets in 99 countries. No vendor, CVE, or actor is named; the count measures reach, not victims.
Apple has sent a new round of threat notifications to users it believes were targeted by mercenary spyware, this time reaching users in 99 countries. Apple has not published a statement, named a spyware vendor, named a threat actor, or tied the campaign to any specific exploit. If you received one, treat it as credible and act; if you didn't, there is nothing in this notification to patch.
What Apple actually said
The 99-country figure comes from the notification text itself, surfaced in a screenshot posted by threat researcher Costin Raiu, as The Record reports. Apple's standard notice cites the "extreme cost, sophistication, and worldwide nature of mercenary spyware attacks" and deliberately declines to attribute. Apple's own threat-notification page still carries an August publication date and does not list this round.
Two points of skepticism, because the headline number invites misreading:
- 99 countries is reach, not victim count. It reflects where notified users are located, not how many devices were hit. Apple has never published the second figure. Techaeris reports this batch is distinct from the August wave and tied to new activity.
- Prior waves landed on 92, 98, and 110 countries. Apple says it has notified users in over 150 countries to date and sends alerts several times a year. A new wave is routine operational tempo, not a step change.
Who's confirmed targeted
Named recipients in this round, per The Record: Ragıp Soylu, a Turkey-based reporter for Middle East Eye, who said it was his third Apple threat notification this year; and Radwan Mortada, a Lebanese documentary filmmaker whose phone was previously hit with Pegasus in 2017 and 2021. Raiu noted that in at least one case "we do not see any signs of compromise in the logs" that would identify the responsible actor — forensic attribution from the notification alone is not possible.
Action checklist
If you received an Apple threat notification:
- Believe it and move. Apple sends these only on high-confidence signals and errs toward silence, not false positives.
- Enable Lockdown Mode on iOS/iPadOS/macOS. It is the single most effective built-in mitigation against the zero-click chains these operators use.
- Update immediately to the latest OS, and reboot — some implants do not survive a reboot.
- Get expert forensics. Contact Access Now's Digital Security Helpline or Citizen Lab rather than attempting self-diagnosis; mercenary implants are built to evade on-device inspection.
- Journalists, activists, dissidents, and their contacts are the recurring target set. If that's your threat model, assume you're in scope regardless of whether you were notified this round.
Context
John Scott-Railton of Citizen Lab argues the notifications are the accountability mechanism that works: "Apple Threat Notifications make accountability happen." Apple's August change to make the alerts more visible appears to be having that effect. The quieter story is the one Apple won't tell — with no vendor named and no CVE disclosed, defenders get a warning signal but no indicator to hunt on, which is exactly the asymmetry the mercenary-spyware market is built to preserve.