Apple has sent a new round of spyware threat notifications to targeted iPhone users in 99 countries. Recipients include journalists and several members of Germany’s parliament. This is the second wave in less than three months, after an August round reached users in 110 countries.
The alerts began arriving on October 29, 2026. Apple has not announced the round publicly. Threat researcher Costin Raiu shared the notification text on X, and that text states the 99-country figure. Raiu told The Record from Recorded Future News that he had verified several victims’ notices.
What the Apple spyware alert says
The warnings concern “mercenary spyware.” Apple uses that term for commercial surveillance tools whose attacks cost millions of dollars. Its support page on threat notifications says these attacks target a very small number of people. Targets are often chosen because of who they are or what they do. Journalists, activists, politicians and diplomats are typical examples.
Apple does not name the attackers or the regions involved. It also keeps quiet about how many people got alerts and what triggered them. The company calls its notifications high-confidence, but not certain. Apple did not respond to The Record’s request for comment.
Raiu said the logs he reviewed showed no signs of compromise that could identify the responsible actor. No group has been publicly linked to this wave so far.
Who received the alerts
Journalists in Turkey and Lebanon
Ragip Soylu, Turkey bureau chief for Middle East Eye, posted on X that this was his third Apple threat notification this year. He wrote that “likely state actors using mercenary spyware have repeatedly tried to hack my phone.” He called the warning a “badge of honour” for his reporting. He has not named a specific organization behind the attempts.
Radwan Mortada is a Lebanese investigative journalist, author and documentary filmmaker. He announced his alert on X. Mortada told The Record that NSO Group’s Pegasus spyware was used against his phone in 2017 and 2021.
His new alert came shortly after the release of his Al Jazeera 360 documentary on the September 2024 pager explosions in Lebanon. Mortada said Israeli soldiers afterward entered his family home in southern Lebanon, looted it and blew it up. He said he has no concrete evidence linking these events to the alert. Still, he said the timing raises “serious questions that cannot simply be dismissed.”
Mortada also warned that spying on journalists puts their sources at risk. Surveillance “threatens the confidentiality of those who trust us with sensitive information,” he told The Record.
German lawmakers
Germany’s Federal Office for Information Security (BSI) says several Bundestag members and other public figures received alerts from October 29. The agency wrote to lawmakers on October 30 about the risk and the steps to take. TNW reported on the BSI guidance and the German cases.
Government spokesperson Stefan Kornelius told the Financial Times that the government is taking the warning “very seriously,” according to TNW. He did not say which members of the federal government were targeted. TNW also noted that Germany’s federal police bought a version of Pegasus, which the government disclosed to a Bundestag committee in 2021.
What changes for you: what to do if you get an alert
Most iPhone owners will never see one of these warnings. Apple says the vast majority of users are not targeted by attacks like these. For people who do get one, Apple and the BSI both offer guidance. The BSI’s advice page is the more detailed of the two.
Step 1: Confirm the alert is real
A genuine Apple threat notification shows up in these places:
- On the iPhone Lock Screen and in the Settings app.
- In an email from [email protected], sent to addresses linked to your Apple Account.
- As a banner at the top of account.apple.com after you sign in.
Apple never asks you to click links, open files or install apps or profiles. It also never asks for your password or verification codes. If in doubt, type account.apple.com into your browser yourself instead of following any link.
Step 2: Get expert help and decide on forensics
Apple recommends contacting experts and points recipients to the Digital Security Helpline run by the nonprofit Access Now. The helpline operates around the clock. The BSI advises updating the operating system right away, unless you plan a forensic analysis of the phone.
Step 3: Turn on Lockdown Mode
Apple and the BSI both recommend Lockdown Mode. On an iPhone, open Settings, then Privacy and Security, then Lockdown Mode. Tap Turn On Lockdown Mode, then Turn On and Restart. The BSI says to keep it on permanently, including on any new device.
Lockdown Mode limits message attachments, link previews and FaceTime calls from unknown contacts. Phone calls and plain text messages keep working. According to the BSI, it makes new attacks harder but does not remove an existing infection.
Step 4: Reset your phone and accounts if the risk is high
The BSI tells recipients to assume their device may be compromised. Warning signs include frequent crashes or unusually fast battery drain. If you judge the risk to be high, the agency suggests these steps:
- Consider replacing the phone and changing your phone number.
- Reset all accounts you used on the device.
- Set a new device passcode that differs from the old one.
- Change passwords for your Apple Account, email and other accounts, and confirm two-factor authentication is on.
- Add a new trusted phone number to your Apple Account, then remove the old one.
- Set up authenticator apps again on each service instead of transferring them.
- Turn on Registration Lock in Signal and two-step verification in WhatsApp, each with a new PIN.
- Remove any linked devices you do not recognize in WhatsApp and in your Apple Account.
The BSI also asks recipients to report alerts to its service center at [email protected]. The agency says these reports help it judge the scale of the incident.
What this spyware can do
The BSI describes mercenary spyware as commercial surveillance software that state actors often use against selected people. Pegasus, made by NSO Group, is the best-known example. In documented cases, phones were infected through “zero-click” attacks. A manipulated message can infect a device without the owner opening or tapping anything. Victims usually notice nothing.
Once spyware compromises a phone, attackers can read messages, including those in encrypted apps. They can also access calls, contacts and calendar entries, track the device’s location, and switch on the camera and microphone.
An alert does not prove an attack succeeded, though. Apple’s warnings flag targeting, not confirmed infection. The BSI says it does not know whether the German recipients’ phones were breached or only targeted.
How this wave compares with earlier rounds
Apple has sent threat notifications several times a year since 2021. Over that period, it has notified users in more than 150 countries. Recent rounds look like this:
| Round | Countries reached | Reported by |
|---|---|---|
| April 2024 | 92 | TechCrunch |
| July 2024 | 98 | TechCrunch |
| August 2026 | 110 | TechCrunch |
| Late October 2026 | 99 | The Record, BSI |
A country count shows how far a round reached. It does not show how many people were targeted, and Apple has never published that number.
The August round was the first in which Apple pushed alerts to the iPhone Lock Screen and Settings, not just email. Access Now said it then received a record number of help requests, about 30 to 40 percent above its usual volume after a new round. Citizen Lab researcher John Scott-Railton told TechCrunch the scale and geographic spread of public posts were “pretty unprecedented.”
Scott-Railton told The Record this week that the alerts became more visible in August. He said targets coming forward publicly shows the system is working. In his words, “Apple Threat Notifications make accountability happen.”
What remains unclear
Apple has not said how many people received this round or whether one actor is behind it. It has not published the new notifications on its website. Beyond the German cases, no government has detailed how many officials were warned. Raiu’s early log checks found nothing that identifies an attacker.
