Apple says it has warned users in more than 150 countries about suspected mercenary spyware attacks since 2021, highlighting the global reach of sophisticated surveillance tools used to target a small number of people.
Unlike common malware campaigns or online scams, these operations target specific people because of who they are or what they do. Journalists, activists, politicians and diplomats have been among the reported targets.
Mercenary spyware attacks can cost millions of dollars and use advanced tools designed to secretly compromise individual devices. The methods also evolve quickly as developers seek new ways to evade security protections.
Public reporting and research have historically linked such operations to state actors and private surveillance companies working on their behalf. Pegasus, developed by Israel-based NSO Group, is among the best-known examples. The spyware has previously been linked to the targeting of journalists, activists and political figures around the world.
Concerns over commercial surveillance tools have also surfaced in Greece. An investigation into the Predator spyware uncovered a wide network of targets, including politicians, government institutions and other prominent figures. Apple does not attribute individual threat notifications to specific attackers or geographical regions.
Apple calls warnings high-confidence alerts
Apple says it relies on internal threat intelligence and investigations to identify activity consistent with mercenary spyware attacks.
The company acknowledges that its investigations cannot provide absolute certainty. However, it describes the notifications as high-confidence alerts that a person has been individually targeted and urges recipients to take them seriously.
Apple does not disclose the evidence that triggers a warning. The company says revealing its detection methods could help spyware operators change their tactics and make future attacks harder to identify.
Apple has sent notifications several times a year since 2021, though it says the vast majority of its users will never be targeted.
How Apple warns targeted users
As of 2026, Apple notifies targeted users directly on their iPhones and by email. An alert can appear on the iPhone Lock Screen and in Settings. A warning also appears at the top of the person’s Apple Account page after signing in online.
Apple says it has warned users in more than 150 countries about mercenary spyware attacks since 2021. The highly sophisticated attacks can target journalists, activists, politicians and diplomats and cost millions to carry out. pic.twitter.com/C5eo1BRLkN
— Tom Marvolo Riddle (@tom_riddle2025) September 2, 2026
Apple recommends that recipients enable Lockdown Mode, which restricts certain device functions to reduce opportunities for sophisticated attacks.
The company also recommends seeking expert assistance, including through Access Now’s Digital Security Helpline, which provides emergency digital security support around the clock.
The dangers posed by commercial spyware have also led to legal action. In February, four business figures linked to Greece’s Predator wiretapping scandal were convicted of violations involving telephone confidentiality.
How to identify a genuine Apple warning
Apple warns users about scams designed to imitate its threat notifications. A genuine warning will not ask someone to click a link, open a file, install an app or profile, or provide an Apple Account password or verification code by email or phone.
Users can verify an alert by signing directly into their Apple Account, where a genuine threat notification will appear at the top of the page. People who believe they face a heightened risk can enable Lockdown Mode even without receiving a warning.
For other users, Apple recommends standard security measures, including software updates, two-factor authentication, strong passwords or passkeys, and device passcodes or biometric protection. The company also advises downloading apps from the App Store and avoiding suspicious links or attachments.
See all the latest news from Greece and the world at Greekreporter.com. Contact our newsroom to report an update or send your story, photos and videos. Follow GR on Google News and subscribe here to our daily email!
