What an Apple threat notification means, and what to do after one

Apple's latest threat notifications reached targeted users in 99 countries, and Germany's cybersecurity agency told recipients to assume their devices may be compromised. Here is what the alerts do and do not establish, how to confirm one is genuine, and what Lockdown Mode and device checks can realistically offer.

An Apple threat notification is a rare, individual warning that the company has detected an attempt to target a specific person with mercenary spyware, a class of expensive surveillance software. It is not an antivirus pop-up, and it is not a confirmation that a phone has been breached. Apple's own support page describes the alerts as high-confidence but concedes that its investigations can never reach absolute certainty.

The topic is in the news because Apple sent a new round of notices on 30 October 2026. According to the notice text, shared by researcher Costin Raiu and relayed by the outlet Cybersecurity News, it went to targeted users in 99 countries. Germany's Federal Office for Information Security, known as the BSI, then reportedly told affected lawmakers and government members to treat their devices as possibly compromised.

Most readers will never see one of these alerts. Still, the questions they raise are practical: how to tell a real notice from a scam, what Apple and security researchers recommend, and what Lockdown Mode can and cannot do. The research behind this article rests largely on Apple's support pages and news reports, and it flags where those sources fall short.

What the notification does, and does not, say

According to Apple's support page on threat notifications, the alerts are meant for people who may have been individually targeted, likely because of who they are or what they do. Apple says the notices are high-confidence and "should be taken very seriously," while acknowledging that its investigations cannot reach absolute certainty.

Apple does not say what triggers a notice. Its page explains that revealing the detection method could help attackers evade it. As a result, outsiders cannot audit the "high-confidence" label, and Apple's assessment has not been independently verified case by case in the sources reviewed here.

Targeting is not the same as infection

TechCrunch reports that Apple does not attribute attacks to specific governments and does not say whether a given phone was actually compromised. That gap explains the BSI's wording. According to TechCrunch, the agency said recipients "should therefore assume that their device may have been compromised." The advice is a precaution rather than a forensic finding, and a report relayed by the ad-hoc-news site says the BSI itself acknowledged having no further knowledge of the specific cause.

There is also a small piece of contrary evidence. According to a secondary summary of reporting by The Record, Raiu said he had examined several victims' notifications and found no signs of compromise in the logs that could identify who was responsible. That is a single, secondhand account. It is consistent with Apple's own statement that a notice signals targeting rather than a confirmed breach, but it does not show that the phones in question were clean.

Who is usually behind these attacks

Apple says mercenary attacks cost millions of dollars and often have a short shelf life, according to a Yahoo Tech report quoting the company. Apple says those traits make the attacks harder to detect and prevent. ZDF reports that, according to Apple, state actors are mostly responsible, with the high price of the software as the stated reason. Apple itself does not attribute individual attacks to particular countries or customers.

The October wave and the German warning

The Next Web reports that Raiu described the October round as separate from an August wave and tied to new attacks. TechCrunch corroborates the 99-country figure through the notice received by Beirut-based filmmaker Radwan Mortada, who said his alert referred to "another attack against your device." He had been targeted by spyware before, in 2021.

The number needs careful reading. "99 countries" counts where recipients are located, not victims, infections or the scale of global exposure. Apple has not published how many people received notices and, according to Techaeris, has never disclosed that figure across the multiple rounds it has sent each year since 2021. Several outlets repeat the 99-country number, but it appears to trace to one notice text, so repetition does not amount to independent confirmation.

An earlier round on 13 August reached targeted users in 110 countries, according to reporting by Fox News and Yahoo. Apple has also said it has notified users in over 150 countries in total. Because the same countries can appear in more than one round, the 110 and 99 figures cannot be added together to count unique countries.

What Germany reported

German outlets heise and ZDF, citing a BSI letter seen by the broadcaster ARD, report that members of the Bundestag and the federal government had received Apple's warning since 29 October. The BSI cautioned that an attacker could read messages, including content from encrypted messengers, according to Apfeltalk. It is not publicly known which politicians were targeted or how many devices were involved, and no forensic result has been made public.

One discrepancy remains unresolved. The Next Web says Apple wrote to Bundestag members on 30 October and asked anyone affected to contact it directly, while the German reports date the notices to 29 October. These may be two separate events, a notice arriving and a follow-up letter, but the sources reviewed do not settle it.

Apple has not named the attackers, the spyware or the underlying flaw in the latest round, according to Techaeris and The420.in. As of 3 November 2026, those details are unknown.

Telling a real notice from a scam

Scammers can imitate security warnings, so verification comes first. Apple's support page says genuine email notices come from [email protected], and iMessage notices from [email protected]. Before April 2025, the email address was [email protected].

Since 2026, Apple has also shown on-device alerts. Malwarebytes reported in August that a warning now appears on the iPhone Lock Screen and in Settings, in addition to the email and the Apple Account page. Fox News quotes the Lock Screen text in part as "Apple detected a mercenary spyware attack targeted at your iPhone."

1. Do not respond through any link, attachment or phone number in the message itself.
2. Sign in at account.apple.com directly. According to BleepingComputer's account of Apple's guidance, a genuine notice appears at the top of the page once logged in.
3. Treat any message that asks for a password or verification code, or tells the recipient to install an app or profile, as fake. BleepingComputer reports that real notices make none of those requests.
4. Be skeptical of a caller who suddenly claims to be Apple Support, a warning Fox News relays from the company's guidance.

Steps Apple and researchers recommend

Fox News, summarizing Apple's guidance, lists the core steps as updating devices, enabling Lockdown Mode and securing Apple Accounts. Apple also recommends seeking expert help and names the Digital Security Helpline run by the nonprofit Access Now, according to Malwarebytes. HuffPost describes the helpline as supporting human rights defenders at all hours.

Eligibility is an open question. Several summaries describe the helpline as aimed at civil society, journalists and activists, and Access Now's own page was not reviewed. Whether it would assist an ordinary US consumer is unconfirmed. Amnesty International's Security Lab, which offers forensic support, says on its help page that it may need access to a person's devices and their contents, and may require personally identifiable information.

Basic hygiene still applies

A German IT service site, summarizing the BSI's advice, lists baseline measures: current software, a passcode with Face ID or Touch ID, two-factor authentication, a strong Apple Account password, apps only from the App Store, and no links or attachments from unknown senders. This is a secondary summary, not the BSI's own text. These measures are general protections and are not a guarantee against mercenary spyware.

Update first, or preserve evidence?

A secondary report from iGeeksBlog says the BSI advised updating iOS immediately unless experts are already examining the phone. The implied tension is that updates close security holes but may alter forensic traces. No primary guidance reviewed here settles the question, and the claim rests on a single secondary source, so it should be read as an unresolved trade-off rather than a rule.

Lockdown Mode: what it does and what it costs

Apple's platform security documentation describes Lockdown Mode as an optional, extreme form of protection for the very few people who might be personally targeted by sophisticated threats such as mercenary spyware. Apple states that most people are never targeted by attacks of this nature. The feature launched in 2022, according to MacRumors, and is available on iOS 16 or later, iPadOS 16 or later, watchOS 10 or later and macOS Ventura or later. Additional protections begin with iOS 17 and macOS Sonoma.

On an iPhone, the setting sits under Settings > Privacy & Security > Lockdown Mode, followed by Turn On Lockdown Mode, according to Apple's iPhone User Guide. Bitdefender's blog adds that the device restarts. Apple's support page says each device needs it separately, so an iPhone, iPad and Mac must all be switched on individually. A paired Apple Watch follows the iPhone.

Apple's page also says that someone who has not received a notice but has good reason to think they may be targeted can enable the mode. The protection comes with real functional costs.

Apple says trusted apps and websites can be excluded from the restrictions, but advises excluding only those that are trusted and only when necessary. Each exclusion reopens some of the surface the mode is designed to close.

The evidence that it works

In March 2026, Apple told TechCrunch: "We are not aware of any successful mercenary spyware attacks against a Lockdown Mode-enabled Apple device," as relayed by MacRumors. The same report quotes Donncha Ó Cearbhaill, head of Amnesty International's Security Lab, saying his team has not seen evidence of an iPhone being compromised by mercenary spyware while Lockdown Mode was on. Amnesty and Citizen Lab have documented numerous successful iPhone attacks, but none involved a Lockdown Mode bypass.

There is also direct evidence of blocked attacks. MacRumors reports that Citizen Lab confirmed at least two cases where Lockdown Mode stopped an attack, one involving NSO's Pegasus and one involving Predator. An earlier TechCrunch report on Citizen Lab research said targets' iPhones blocked the attempts and displayed a notification that Lockdown Mode had prevented access to the Home app. A MacRumors forum post also reports, secondhand, that Google researchers found spyware coded to abort when it detected Lockdown Mode.

Why the record is encouraging but not conclusive

"No known cases" is not the same as "no cases." The claim cannot exclude attacks that were never detected, and the researchers' statements cover only what their methods can see. The user base is also small and self-selected, and the number of high-risk people who actually run Lockdown Mode is unknown. The pattern still points in one direction: Apple, Amnesty and Citizen Lab align, and spyware that aborts on detecting the mode suggests vendors treat it as a genuine obstacle.

One limit matters for anyone who has already received a notice. According to the iGeeksBlog report of BSI advice, Lockdown Mode makes new attacks harder but does not remove an infection that is already present. That rests on a single secondary report, and the BSI's own text was not reviewed.

Can a phone be checked for infection?

Nothing found in this research indicates that Apple offers a consumer "scan for spyware" feature, and Apple declines to reveal what triggers a notice. The main open-source forensic option is the Mobile Verification Toolkit, or MVT, released in July 2021 as part of the Pegasus Project. Its documentation says it helps identify traces of compromise by sophisticated mobile spyware, but that it is intended for technical users with forensic experience, not for end-user self-assessment.

The project's PyPI page adds a caution: relying on public indicators alone can miss recent forensic traces and produce a false sense of security. Reliable triage needs non-public indicators and threat intelligence, which are available to civil society through Amnesty's Security Lab or its partnership with Access Now's helpline. A clean result from a do-it-yourself check, in other words, is weak reassurance.

What it means, and what to watch

The notices put a public face on a business that usually operates unseen. Apple has issued them multiple times a year since 2021 without saying how many people receive them, so the 99-country figure describes geography, not scale. For a typical reader, the realistic risk of receiving one is low, and the protections Apple promotes are built for a narrow group.

The more useful lesson is about how to read a warning. A notice is a signal of targeting from a company that will not explain its method, and a precaution like the BSI's is only a precaution. Whether the German devices turn out to have been compromised, who was behind the October wave, and whether Lockdown Mode's clean record survives another year are the open questions to watch.

Frequently asked questions

Does an Apple threat notification mean my iPhone was hacked?

No. Apple describes the notices as high-confidence alerts that a person was individually targeted by mercenary spyware, but it does not say whether the phone was actually compromised. Apple also acknowledges that its investigations can never reach absolute certainty.

How can I tell whether an Apple threat notification is real?

Apple's support page says real email notices come from [email protected] and iMessage notices from [email protected]. According to BleepingComputer's account of Apple's guidance, signing in at account.apple.com should show a genuine notice at the top of the page. Real notices do not ask for passwords, codes, app installs or clicks on links.

Should I turn on Lockdown Mode?

Apple calls it an optional, extreme protection for the very few people who might be personally targeted, and says most people never face such attacks. It restricts message attachments, links, some web technologies and incoming FaceTime calls from unknown contacts. It must be enabled separately on each device, and Apple says someone with good reason to suspect targeting can turn it on even without a notice.

Does Lockdown Mode remove spyware that is already on a phone?

According to a secondary report of BSI advice, it makes new attacks harder but does not remove an existing infection. That claim rests on a single secondary source, because the BSI's own text was not reviewed. Apple's reported record is that it knows of no successful mercenary spyware attack on a Lockdown Mode device.

Can I scan my own iPhone for spyware?

Amnesty's Mobile Verification Toolkit exists, but its documentation says it is for technical users with forensic experience and not for self-assessment. Its maintainers warn that public indicators alone can miss recent traces and give false reassurance. Apple recommends expert help, and names Access Now's Digital Security Helpline, though whether it assists ordinary US consumers is unconfirmed.

Sources

1. About Apple threat notifications and protecting against mercenary spyware , Apple Support
2. About Lockdown Mode - Apple Support , Apple Support
3. Harden your iPhone from a cyberattack with Lockdown Mode , Apple Support
4. Lockdown Mode security for Apple devices , Apple Platform Security
5. About Lockdown Mode (en-my) , Apple Support
6. About Lockdown Mode (en-nz) , Apple Support
7. Germany says lawmakers' iPhones may have been hacked with spyware , TechCrunch (2026-11-02)
8. Apple Says No iPhone in Lockdown Mode Has Ever Been Hacked , MacRumors (2026-03-27)
9. Apple's high security mode blocked NSO spyware, researchers say , TechCrunch
10. Apple Says No iPhone in Lockdown Mode Has Ever Been Hacked (forum thread) , MacRumors Forums
11. Apple spyware alerts reach German MPs and journalists in 99 countries , The Next Web
12. Apple Warns iPhone Users in 99 Countries of Sophisticated Mercenary Spyware Attacks , Cybersecurity News
13. Apple Sends New Threat Notifications to Users in 99 Countries , Techaeris (2026-10-30)
14. Apple Sends Spyware Threat Alerts To Targeted Users Across 99 Countries , The420.in
15. Apple meldet Kompromittierung von Geräten durch Spyware , heise online
16. Digitalminister: Hackerangriffe kommen "schon mal vor" , ZDFheute
17. Hackerangriff auf Politiker:innen: Wildberger bestätigt Apple-Warnung , Apfeltalk
18. BSI warnt nach Apple-Hinweisen: iPhones von Politikern könnten kompromittiert sein , ad-hoc-news.de
19. Apple-Spyware-Warnung: BSI informiert Abgeordnete , S-EDV
20. Apple sends new mercenary spyware warnings to users in 99 countries , iGeeksBlog
21. Apple Issues Urgent Security Alerts Over Mercenary Spyware Attacks in 99 Countries , GBHackers
22. Apple sends new 'Threat Notification' alerts over mercenary spyware attacks , BleepingComputer
23. Apple now uses iPhone alerts for targets of mercenary spyware , Malwarebytes
24. Apple sends mercenary spyware attack alerts to iPhone Lock Screen , Fox News
25. Here's how to check if that Apple Threat Notification on your iPhone is real , Yahoo Tech
26. Apple's 'Mercenary Spyware' Warning Text Is Real , HuffPost
27. Apple's Lockdown Mode Explained: What It Does, Who Needs It, and How to Turn It On , Bitdefender
28. Get Help - Digital Forensic Support , Amnesty International Security Lab
29. Mobile Verification Toolkit (MVT) Documentation , Mobile Verification Toolkit project
30. mvt package page , PyPI
31. Apple's spyware alert hit 99 countries, and Germany says treat the iPhone as hacked , martincid.com

This article was drafted with the help of AI and reviewed by Jaroha editors before publication.