Apple warns iPhone users in 110 countries about mercenary spyware: what the Lock Screen notification means
If your iPhone showed an unusual security warning on August 13, you were not alone. Apple sent a new batch of mercenary spyware threat notifications to users in 110 countries, covering the widest geographic distribution since the company began sending these alerts in 2021.
The notifications also arrived differently this time. For the first time, the warning appeared as a push notification directly on the iPhone Lock Screen, not just in email.
What Apple's threat notifications are
Apple's mercenary spyware threat notifications are sent when the company's internal systems detect indicators suggesting that a specific device was targeted by highly sophisticated spyware, typically the kind developed or licensed by private surveillance vendors. The most well-known product in this category is NSO Group's Pegasus, but Apple's notifications do not name the specific spyware used.
These notifications are not mass alerts. Apple sends them to specific individuals whose devices showed targeting indicators. The company has been doing this since 2021 and typically sends multiple rounds per year.
Who gets targeted
Apple's public guidance is clear: the notifications go to individuals such as journalists, activists, politicians, and diplomats. This is consistent with every public disclosure about mercenary spyware targeting since Pegasus was first documented. Nation-states and their contractors use these tools against specific people of political interest, not the general population.
What is different about August 13
Two things set this round apart. The scale: 110 countries is the largest geographic footprint Apple has disclosed for a single notification round. The delivery: Lock Screen push notifications instead of email-only alerts. Apple explicitly updated its support page to describe the new delivery method. A Lock Screen alert is harder to miss than an email that can sit unread for a week.
What to do if you received one
Enable Lockdown Mode on your iPhone. Lockdown Mode restricts features that mercenary spyware commonly exploits, including certain JavaScript execution paths, link previews, and attachment processing. The tradeoff is reduced functionality on some apps and websites, which is acceptable given the threat level.
Update iOS to the latest version. Contact Access Now's Digital Security Helpline or your organization's security team for a device assessment.
Do not ignore the notification. Apple states it cannot promise perfect accuracy in its threat detection, but the combination of sophistication required to trigger a notification and the deliberately narrow targeting profile means receiving one is worth treating seriously.
Why the Lock Screen change matters
The switch from email to Lock Screen delivery reflects Apple's own assessment that email notifications were insufficient. Recipients sometimes did not see them. In a threat model where a compromised device is used to surveil the owner in real time, a missed email notification has no protective value. A Lock Screen alert that cannot be ignored does.
Gigia Tsiklauri is a Security Architect and founder of Infosec.ge. Get in touch if your organization needs a security assessment for high-risk personnel or journalists operating in sensitive environments.