Overview
On October 30, 2026, Apple sent a new round of threat notifications to users it believes were targeted by mercenary spyware. The wave reached users in 99 countries. Apple says it has now notified users in more than 150 countries in total. Recipients include journalists and documentary filmmakers.
The previous major batch went out in August and covered 110 countries.
Timing
The alerts arrive shortly before final negotiations on guidelines for the use of commercial hacking tools under the Pall Mall Process, the voluntary initiative launched by the UK and France. Its Code of Practice for States was adopted in Paris in April 2025 with an initial 25 backing states.
Natalia Krapiva of Access Now said the number of notifications shows the fight against spyware abuse is far from over.
What Apple Hasn't Said
Apple has not named a spyware product, a delivery method, or a specific software flaw behind this wave, and it does not attribute notifications to particular countries or governments.
Recognizing a Real Notification
Apple says genuine threat notifications never ask you to:
- Click a link
- Open a file
- Install an app or configuration profile
- Provide a password or verification code
Scammers have been known to imitate these alerts, so verify through your Apple Account page at account.apple.com rather than any message link.
If You Receive One
- Update iOS, iPadOS and macOS to the latest release immediately
- Enable Lockdown Mode (Settings, Privacy & Security)
- Contact a specialist such as Access Now's Digital Security Helpline or Amnesty's Security Lab
- Preserve the notification and avoid wiping the device before expert review