What we know so far: Apple has issued high-priority threat notifications to iPhone users in 110 countries, warning them that they may have been targeted by sophisticated mercenary spyware. The company did not disclose details about the threat itself or the individuals suspected of being behind the attacks. However, it recommended several steps users can take to help protect their data and devices.
The spyware attacks were first reported on October 30 by cybersecurity researcher Costin Raiu, who noted that they were unrelated to the previous round of incidents, for which Apple issued alerts in August. According to Raiu, iPhone users in 99 countries, including several prominent journalists and documentary filmmakers, are among those who received the notifications.
On October 31, Apple confirmed that it had sent high-confidence threat notifications to select users in 110 countries worldwide, warning them that they may have been targeted by mercenary spyware. The company did not confirm whether any devices or accounts had been compromised, nor did it publicly identify the threat actors, attack vector, or software vulnerability associated with the incident.
While Apple has remained tight-lipped about the details, it has confirmed that the attacks are not broad phishing scams affecting millions of people but highly targeted attempts to exfiltrate data from specific individuals. Apple did not identify the victims, but mercenary spyware is known to target journalists, activists, politicians, and diplomats.
Targeted attacks are designed to compromise devices without requiring victims to download a file or even click an external link. When successful, these attacks can give threat actors deep access to victims' devices, potentially allowing them to retrieve private information such as call logs, messages, contact lists, location data, and media files.
– Costin Raiu (@craiu) October 30, 2026
According to Apple's threat notification guidance, zero-click exploits and other types of mercenary spyware attacks are expensive, often costing millions of dollars. The company notes that the high costs and technical complexity involved in carrying out these attacks mean that only extremely well-funded operations can deploy them effectively.
Apple also noted that the short lifespan of targeted mercenary spyware attacks makes them difficult to detect and prevent. The company says the only way to learn more about the threat actors' modus operandi is through internal threat intelligence. It added that it typically withholds technical details about its detection methods to prevent attackers from learning how to circumvent its detection and remediation measures.
Apple advises users who may be facing a targeted cyberattack to enable Lockdown Mode. The feature is designed to protect iPhone users against sophisticated cybersecurity threats by limiting access to features that attackers could exploit. It can be found under Settings > Privacy & Security on supported iPhones. Apple also recommends keeping devices up to date to ensure they receive the latest security patches.