Recognising and responding to Apple threat notifications

On 13 August Apple sent threat notifications to users in 110 countries, warning that their iPhones had been targeted by mercenary spyware, which private companies develop for governments, such as NSO Group's Pegasus. Apple has sent such notifications several times a year since 2021 and had notified users in over 150 countries as of 13 August. According to Apple's support page, the vast majority of users will never be targeted.

In a 2 September newsletter, the press freedom nonprofit Freedom of the Press Foundation (FPF) urged readers to take the alerts seriously. In its support page updated in August 2026, Apple likewise calls them high-confidence alerts to be taken very seriously, though its investigations can never achieve absolute certainty. FPF also relayed an explainer from the digital rights nonprofit Access Now: a notification does not say whether the attack succeeded or who was behind it.

Apple lists three channels: an alert on the iPhone Lock Screen and in Settings, email to the addresses linked to the Apple Account (from [email protected] as of 2026), and a banner after signing in to account.apple.com. The format may vary by device model and software version.

Apple advises recipients to turn on Lockdown Mode, a built-in setting that restricts some features to reduce risk, and to seek expert help such as Access Now's round-the-clock Digital Security Helpline. FPF also suggested that Android users look into Google's comparable Advanced Protection.

Perspective

A genuine notification recommends protective steps such as Lockdown Mode, but never asks you to click links, open files, install apps or profiles, or give a password or verification code. If a message claiming to be from Apple does, sign in to account.apple.com yourself and check for the banner.

Apple does not attribute attacks to specific attackers or regions, and does not explain what triggers a notification. When a batch reached people in India in October 2023, Apple told TechCrunch that some notifications might be false alarms and some attacks might go undetected, wording that differs from the current support page.

According to Access Now's helpline page, as of 29 September the service replies to every request within two hours and supports ten languages: English, Spanish, French, German, Portuguese, Russian, Tagalog, Arabic, Italian and Ukrainian. Tagalog, spoken in the Philippines, is the only East or Southeast Asian language on the list, so Chinese speakers and others in East Asia may need to write in English, or first turn to a local digital security group they trust. Whether the helpline can be reached from mainland China is a separate question: OONI, a project that measures internet censorship, recorded 76 tests of the Access Now homepage from there in September, 73 of them without anomalies.

A security researcher quoted by TechCrunch in March said Lockdown Mode blocks most message attachment types and restricts WebKit browser engine features, shrinking the attack surface, especially for zero-click exploits that need no action from the victim. On 27 March Apple told TechCrunch it was not aware of any successful mercenary spyware attack against a device with Lockdown Mode on. The same article noted that an undetected bypass cannot be ruled out.

The trade-off is that devices no longer work as usual: apart from certain images, video and audio, most message attachments are blocked, links and link previews are unavailable, and some websites may load slowly or break. Trusted websites and apps can be excluded, which weakens protection.

On iPhone, Lockdown Mode needs iOS 16 or later and sits under Settings > Privacy & Security > Lockdown Mode, and turning it on restarts the device. iPad (iPadOS 16 or later) and Mac (macOS Ventura or later) must each be switched on separately, while a paired Apple Watch follows the iPhone. Both the instructions and the interface come in Simplified and Traditional Chinese. People with good reason to think they may be targeted need not wait for a notification before turning it on.