Apple Threat Notification: What the "Mercenary Spyware" Alert Means and What to Do Next

By The Nadeemi team · Checked on 2026-11-06

Checked against Apple's support page and CyberScoop's report, 6 November 2026. This is general safety information, not personal security advice.

On Friday 30 October 2026, Apple sent a new round of threat notifications to iPhone users in 99 countries, warning that they may have been targeted by mercenary spyware. Journalists and documentary filmmakers were among those who posted their alerts. Apple says it has now notified people in more than 150 countries in total (CyberScoop, 30 Oct 2026).

How to tell a real alert from a fake

Scammers copy these alerts, so check the channel, not the wording. According to Apple's support page:

• Real: a Threat Notification on the iPhone Lock Screen and in Settings; an email from threat-notifications@email.apple.com; a banner at the top of account.apple.com when you sign in there yourself.
• Fake: any message that asks you to click a link, open a file, install an app or a profile, or to share your Apple Account password or a verification code. Apple's alerts never do.
• Verify: type account.apple.com into your browser yourself and sign in. If there is no banner, treat the message as phishing.

Apple calls these "high-confidence alerts" that "should be taken very seriously", but it does not say who was behind an attack.

What to do in the first hour

1. Do not panic, and do not reset your phone yet. Experts may want to examine it.
2. Turn on Lockdown Mode (Settings > Privacy & Security > Lockdown Mode). It limits message attachments, link previews, web features and incoming calls from unknown people, which are common ways in.
3. Update iOS and every app.
4. Contact the Access Now Digital Security Helpline, which Apple recommends and which answers 24/7.
5. Secure your accounts: strong unique passwords or passkeys, two-factor authentication, and Stolen Device Protection.
6. Tell close contacts by a channel you trust that your phone may be watched, so they can be careful too.

What it means for WhatsApp, Signal and other chats

Encryption protects messages on the way, not on a hacked phone. Mercenary spyware works by taking over the device itself, where messages are shown in plain text. End-to-end encryption in WhatsApp, Signal or any other app does not help once the phone is compromised. That is why the advice is about the device (Lockdown Mode, updates), not about switching apps.

Two settings still reduce risk:

• Disappearing messages: less old history on the phone means less to steal.
• Fewer linked devices: every laptop and tablet signed in to your chats is another place they can be read.

Interestingly, Lockdown Mode turns off most link previews in Messages, because previews make your phone open links automatically. We explain why in link previews and privacy.

How Nadeemi fits in

Nadeemi is the app we build, so weigh this section accordingly. No app can protect you from spyware already on your phone, and Nadeemi is no exception. What we can do is ask for less: no phone number (a common way people are identified and reached), no AI features, no ads, devices that must be approved before they can read new messages, and disappearing messages. Chats are encrypted on your device with MLS in the beta; we label them "end-to-end encryption coming" until an independent audit is published. Link previews in Nadeemi are made through our server, so the site never sees your IP address, and people who receive a link never fetch it.

FAQ

Is the Apple threat notification email real? It can be. Real ones come from threat-notifications@email.apple.com and never ask you to click links or give a password. Check by signing in at account.apple.com yourself.

Who sends mercenary spyware? Apple does not attribute the attacks. Mercenary spyware is sold by private companies and is usually used against a small number of people, such as journalists, activists and officials.

Will changing to another messaging app protect me? Not if the phone itself is compromised. Secure the device first (Lockdown Mode, updates, expert help).

What is the Pall Mall Process? A voluntary international effort, mentioned in CyberScoop's report, to set standards for the commercial hacking tool industry.

Sources (checked 6 November 2026)

• CyberScoop, Apple notifications alert victims in 99 countries about mercenary spyware infections (30 Oct 2026): https://cyberscoop.com/apple-spyware-notifications-pall-mall-process/
• Apple Support, About Apple threat notifications and protecting against mercenary spyware: https://support.apple.com/en-us/102174
• Apple Support, About Lockdown Mode: https://support.apple.com/en-us/105120
• Access Now, Digital Security Helpline: https://www.accessnow.org/help/
• Nadeemi, what we can and can't see: https://nadeemi.com/what-we-can-see/

Names of other apps are trademarks of their owners, used only for comparison. Nadeemi is not affiliated with any of them.

Drafted with AI help and checked by a person on the date above.