Apple is once again sending “Threat Notification” alerts to users whose iPhones it believes have been individually targeted by mercenary spyware. If you received an email or iMessage from Apple saying it detected a “mercenary spyware attack targeted at your iPhone,” the alert is real — and you should take it seriously.
Apple has been issuing these notifications since 2021 whenever its internal threat intelligence detects highly targeted spyware campaigns. The company does not name the spyware variant behind each wave of alerts, but it has historically cited NSO Group’s Pegasus as an example of the kind of commercial surveillance tools involved. Past forensic investigations into similar Apple notifications have confirmed Pegasus infections. The targets are typically journalists, activists, politicians, and diplomats — people in high-risk roles. These attacks are expensive to carry out and affect a very small fraction of users worldwide.
How to check if you’re affected
Affected devices are iPhones and Apple devices that belong to users Apple has individually flagged as at-risk targets. If you received an Apple Threat Notification, you can verify it is genuine:
- Sign in directly to account.apple.com — if a notification was sent to you, it will appear at the top of the page.
- Apple will never ask you to click a link, open a file, install an app, or provide your Apple Account password via the notification.
- If you believe you were targeted, enable Lockdown Mode on your device immediately and contact a digital-security expert or a trusted organization like Access Now’s Digital Security Helpline.
The vast majority of iPhone users will never receive one of these alerts. If you did not get a notification, there is nothing to check.