Apple's spyware alerts hit 99 countries, and fakes are the bigger risk
Apple sent a new wave of threat notifications Oct 29; verify any alert only by signing in at account.apple.com.
Apple · Macfolio · 2 November 2026
Apple has sent a new wave of threat notifications to people it believes were individually targeted by mercenary spyware. The notice, shared publicly by security researcher Costin Raiu on October 30, 2026 and quoted by CyberScoop, says it "is being sent to targeted users in 99 countries" and that Apple has now notified users in more than 150 countries in total. France's national cybersecurity agency, CERT-FR, lists the wave as a new campaign dated October 29, 2026, following earlier ones on February 26 and August 13 this year. Apple has not published a press release about it.
What a genuine alert looks like
According to Apple's support document on threat notifications, a real alert arrives in three ways:
- an Apple Threat Notification alert on the iPhone Lock Screen and in Settings
- an email to the addresses on your Apple Account, sent from "threat-notifications@email.apple.com"
- a banner at the top of your Apple Account page after you sign in at account.apple.com
Apple says genuine notifications never ask you to click links, open files, install apps or profiles, or provide your Apple Account password or a verification code. The safest check is to type account.apple.com into a browser yourself and look for the banner.
Who should act, and how
Apple calls these high-confidence alerts that should be taken very seriously, while admitting its investigations can never be absolutely certain. If you receive one, Apple recommends turning on Lockdown Mode and contacting the Digital Security Helpline run by the nonprofit Access Now, which operates around the clock. Lockdown Mode works on iOS 16, iPadOS 16, watchOS 10 and macOS Ventura or later, with extra protections from iOS 17 and macOS Sonoma, and it deliberately breaks things such as most Messages attachments, some web technologies and unknown FaceTime calls.
This does not mean ordinary Mac or iPhone users are at risk. Apple says the vast majority of people will never be targeted, and 99 is a count of countries, not of victims or confirmed infections. Apple does not name attackers, spyware vendors or affected regions.
Our take: the most useful thing for most readers is knowing how to spot a fake. Waves like this tend to inspire phishing that copies Apple's wording, so treat any "spyware alert" that asks you to act through a link as a scam.
Caveats: the 99-country figure comes from the notification text rather than an Apple announcement, Apple's support page still carries an August 13 date, and the number of recipients is unknown.