Apple Alerts Device Users in 99 Countries to Mercenary Spyware Targeting

Key points

• Apple warned users in 99 countries about suspected mercenary spyware targeting.
• The notices are intended for likely targets, not every Apple customer.
• No CVE is associated with this activity.
• Recipients should verify the alert through official Apple support channels.

Apple has started reaching out to customers in 99 countries after finding indications that their Apple devices were being singled out by for-hire spyware groups. The company sent alerts to those users to warn them. No CVE has been assigned to this activity.

The notices are not broad advisories for every Apple customer. They are intended for people and devices that Apple assesses as likely targets of a focused spyware operation. A recipient should treat the message as a signal that their account or hardware may be at elevated risk, while other users should not assume they are affected.

Targeted spyware can give an attacker access to messages, calls, location data, credentials, and other sensitive material. Because this campaign has no CVE, defenders cannot track it through routine patch bulletins alone. Apple's warning is therefore an important early indicator for the individuals who received it.

Apple has used threat notifications in past cases to flag suspected mercenary spyware activity. This wave is notable for its geographic breadth, covering 99 countries. The company has not published a list of affected users or countries, and the absence of a CVE means there is no single patch reference to monitor.

What to watch: recipients should verify the alert through official Apple support channels, preserve the original message, and avoid acting on links or instructions from unexpected follow-up emails. IT teams should be ready to help high-risk staff review account security and device updates. Organizations should also watch for phishing that references the notification.

What to do now

1. Validate any Apple threat notification by contacting Apple Support through official channels; do not use links from the message.
2. Preserve the notification and affected device state; avoid wiping or resetting until advised by Apple or incident response.
3. Install the latest Apple operating system and application updates on affected devices.
4. Review Apple ID security: change to a strong unique password, confirm multi-factor authentication, and remove unrecognized trusted devices.
5. Consider Apple Lockdown Mode for high-risk users who received an alert, in line with organizational policy.
6. Report the alert to your IT or security team and document the recipient, time, and device details.
7. Brief staff on follow-up phishing that may reference the spyware warning and remind them to use official support channels.

Original source

The Record