By the Smili Phone team
Apple sent a fresh round of threat notifications to selected iPhone users in 99 countries on October 30, 2026. Security researcher Costin Raiu reported the new wave that day, and said it was separate from the alerts Apple sent in August, and linked to new attacks. The notice itself said Apple has now notified users in more than 150 countries in total.
That headline can sound alarming, and it should be taken seriously. It does not mean every iPhone is at risk, or that millions of phones were hacked. These alerts are narrow, targeted warnings.
What actually happened
Apple's notice said the October 30 notifications went to targeted users in 99 countries. The previous wave, in August 2026, covered 110 countries. The country count describes where the people who received a notification are located. It is not a count of victims, and it is not a count of confirmed infections.
Apple did not name the attackers, any region, or a specific spyware product, delivery method, or software flaw behind this wave. That restraint is deliberate: Apple says it withholds detection details so attackers cannot learn how its systems spot them.
What mercenary spyware means
Mercenary spyware is surveillance software built for a specific target, not a mass scam. Apple says these operations use exceptional resources, can cost millions of dollars, and are aimed at a small number of people, usually journalists, activists, politicians, and diplomats.
That is very different from the phishing texts and fake delivery messages most of us see every week, which try to trick a large number of people at once. A mercenary spyware attack is built around one person, and often tries to get in without that person tapping anything.
Read the alert correctly, too. Apple says a notification means it detected targeting with high confidence. It does not, by itself, prove that an attacker took control of the phone. It is a call to act carefully, not a verdict that your data is already gone.
How to tell a real alert from a fake one
Apple delivers genuine threat warnings through a Lock Screen alert, in Settings, and by email to the address on your Apple Account, with a banner also appearing after you sign in. If you get a message claiming to be one, do not trust the message alone.
Open your account yourself, through the app or website you normally use, and check for the banner there. A genuine notification will never ask you to install an app or a configuration profile, open a file, or share a password or verification code. If a message asks for any of those, treat it as a scam and delete it.
What to do if you receive one
- Update your iPhone to the latest software first, before changing other settings.
- Turn on Lockdown Mode under Settings, then Privacy and Security, then Lockdown Mode. It limits message attachments, some web technologies, incoming FaceTime calls, and profile installation. Some websites and features may work differently afterwards.
- Enable Lockdown Mode on your other supported Apple devices too.
- Seek expert help rather than investigating on your own. Apple points notified users to the Digital Security Helpline run by Access Now, which offers help around the clock.
- Do not factory reset the phone or delete evidence before speaking to an expert, unless they tell you to. A reset can destroy clues about what happened.
What everyone else should do
Apple says most users will never face mercenary spyware targeting. Everyday habits still matter, because they protect you from far more common threats: keep your phone updated, use a strong and unique Apple Account password, turn on two factor authentication, and stay cautious with unknown links and attachments.
If your iPhone is running slowly, missing updates, or showing warnings you do not understand, bring it by our shop in Escondido. We can check the software version, confirm your security settings, and help you sort a real alert from a copycat message.
Related: Your phone's hidden security mode · Scam protection on Android and iOS
