# Apple issues mass spyware alerts in 110 countries

Published: 2026-08-20 · Severity: routine
Canonical: https://vorant.io/reports/f0e7e813-e62e-5a7c-846f-ff6a69b44e46/apple-issues-mass-spyware-alerts-in-110-countries

> Apple sent threat notifications to users in 110 countries warning of suspected mercenary spyware attacks, described by researchers as unprecedented in scale.

Apple's threat notification system, launched in 2021 to warn users targeted by state-sponsored or mercenary spyware, triggered an unusually widespread wave of alerts recently, reaching users across 110 countries. Citizen Lab senior researcher John Scott-Railton characterized the scale and geographic diversity of public reports about these notifications as 'unprecedented,' suggesting a much larger, mostly invisible campaign is underway since only a fraction of affected individuals publicly disclose receiving such alerts.

The article does not name a specific spyware vendor, malware family, or threat actor responsible for this wave of targeting, nor does it provide technical indicators or a specific vulnerability being exploited. It notes that Apple's notification system has historically served as a valuable trigger for deeper investigations that uncover additional victims and campaigns as commercial spyware use continues to grow globally.

For defenders and at-risk individuals, the key guidance is that recipients of an Apple threat notification should treat it seriously and enable Lockdown Mode, a restrictive security feature Apple states has not been bypassed by known spyware to date. This report is primarily an awareness/trend piece rather than a technical advisory, with no IOCs, CVEs, or confirmed attribution provided.

## Mentioned in this report

- Malware: Unspecified mercenary spyware

Source reporting: https://citizenlab.ca/unprecedented-number-of-apple-users-received-recent-spyware-alert

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/f0e7e813-e62e-5a7c-846f-ff6a69b44e46/apple-issues-mass-spyware-alerts-in-110-countries.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup