Apple sends fresh spyware threat notices to users in 99 countries

Apple has started another round of threat notifications to people it suspects were targeted with mercenary spyware, according to a screenshot of the notification posted to X by researcher Costin Raiu. The alert tells recipients that notices went out to targeted users in 99 countries. Raiu said he checked several of the notifications and found them accurate, and that he sees nothing in the logs so far that would confirm which actor is behind the attacks.

Apple doesn't name a suspected operator or region in the notice. It cites the "extreme cost, sophistication, and worldwide nature of mercenary spyware attacks" as the reason. The company didn't respond to a request for comment from The Record and hasn't published the notifications on its website.

Two recipients have shared theirs. Ragıp Soylu, Turkey bureau chief for Middle East Eye, said on X that it was the third Apple threat notification he'd received this year. Radwan Mortada, a Lebanese documentary filmmaker and investigative journalist, also posted that he got one. He told The Record that Pegasus had targeted his phone in 2017 and 2021, and that the new notice came days after the release of a documentary he directed about the September 2024 pager explosions in Lebanon.

Mortada said he has no concrete evidence linking the two, though he called the timing hard to dismiss. He said his bigger worry is the safety of his sources.

What the notices don't establish is who was behind the attempts. Apple's alerts are a warning to a device owner, not an attribution. If you get one, the sensible first step is to treat the phone as possibly compromised and get help from a specialist before you keep using it for sensitive work. Citizen Lab's John Scott-Railton said Apple changed the notifications in August to make them more visible and push people to act.

We'd read the absence of attribution as a limit of the evidence, not a hint at a particular buyer.