Apple Warned People in 110 Countries About Spyware — Here's What's Going On

Apple has sent a new round of spyware attack warnings to users across 110 countries, the largest number of countries ever covered by the company's threat-notification program. The alerts, reported on August 14, 2026, include updated advice on how to protect affected devices, including a built-in safety feature called Lockdown Mode. Firstpost

The warnings were first shared by Citizen Lab senior researcher John Scott-Railton. He noted that spyware tools like Pegasus are used by governments to secretly monitor specific people. Apple sends these notifications when its own systems detect that a user has been individually targeted by such an attack. Engadget

Apple told TechCrunch that it updated the warnings to make it easier for people to find relevant information. The company also published a new support page (support.apple.com/en-us/102174) explaining what this kind of spyware is and what targeted users can do. Engadget

So what is mercenary spyware? It refers to powerful surveillance tools that private companies sell to governments. These tools are used to go after specific people — journalists, activists, politicians, and diplomats. The attacks cost millions of dollars to carry out and are aimed at individuals, not the general public. For most people, the risk is effectively zero. But for those who are targeted, the attacks are very hard to detect and stop. Engadget

Apple says it can never be absolutely certain, but its threat notifications are high-confidence alerts, meaning the company is quite sure a user has been individually targeted. Apple says it cannot reveal how it figures out who is under attack, because that information could help the attackers hide. Engadget

Getting an Apple notification does not necessarily mean the user's data was actually stolen. Rather, Apple detected activity on the device that looked like a spyware attack was underway. The distinction matters: the alert is about being targeted, not about confirmed data theft. Engadget

Apple advises recipients to turn on Lockdown Mode, which puts the device into a maximum-protection setting. When enabled, Lockdown Mode blocks most message attachments, FaceTime calls, invitations for Apple services, and shared photo albums. Users may get notifications when an app or feature is restricted by Lockdown Mode, and a banner in the Safari browser indicates the mode is on. Engadget

Apple also tells targeted users to seek expert help. It specifically points to the Digital Security Helpline run by the nonprofit Access Now, which offers fast, emergency support. Engadget

The scope of Apple's warnings has grown over time. In April 2024, Apple warned users in India and 91 other countries about possible spyware targeting. At that time, the company stopped using the term "state-sponsored attacks" and switched to "mercenary spyware attack," a label that more accurately describes the commercial nature of the surveillance industry. Reuters

In December 2025, Apple sent another round of warnings to users in 84 countries. Google joined in that round, issuing its own parallel alerts. The current round reaches 110 countries, a notable expansion in coverage over roughly eight months. Reuters

The support page Apple published with this round of notifications is worth a closer look. Apple publishes localized versions, including separate US and Ireland editions, suggesting the company is adjusting its guidance for different regulatory and threat environments. The page explains what mercenary spyware is, what Apple can and cannot detect, and the specific steps a targeted user should take. Apple Support

The trajectory is clear, even if the full threat picture is not. Each round of notifications covers more countries and reaches more users. Apple has refined its language, improved the notification experience, and built a support system that points users toward both technical protections (Lockdown Mode) and human experts (Access Now's helpline). The company is also careful to be honest about what it can and cannot promise: high-confidence detection, not certainty, and alerts about targeting, not confirmed compromise.

For anyone advising at-risk users — particularly journalists, activists, diplomats, and politicians — the practical takeaways are simple. Take Apple's threat notifications seriously; they come from a view of the system that most independent investigators cannot match. Enable Lockdown Mode on any device that receives a notification, accepting that it will limit some features. And get expert help rather than trying to investigate alone, since mercenary spyware is built to stay hidden.

The broader context here is that the commercial spyware industry has grown into a well-funded, ongoing operation. Apple's notifications are a defensive move in an uneven fight: the company can detect and warn, but the spyware tools remain in circulation, sold to governments that use them against people whose work makes them targets. The growth from 91 countries in 2024 to 110 in 2026 suggests either that the tools are being deployed more widely, that Apple's detection is improving, or both.