IC Technology & Cyber — 2026-08-21

Citizen Lab Reports Unprecedented Scale of Apple Spyware Threat Notifications Across 110 Countries

BLUFAt least one documented spyware case tied to this batch will very likely surface over the next two months, broadening public exposure of mercenary surveillance vendors and their government clients.

Apple confirmed to BleepingComputer that it sent a new batch of "Threat Notification" alerts on August 13 to targeted users in 110 countries, warning of suspected mercenary spyware attacks against their iPhones 1. Apple does not identify the spyware behind individual alerts or attribute attacks to a specific government, company, or region, though the company has previously cited NSO Group's Pegasus as an example of the mercenary spyware historically associated with such campaigns 1. Citizen Lab senior researcher John Scott-Railton said the scale and geographic diversity of public reports about the notifications are "pretty unprecedented" 2. Apple describes the alerts as "high-confidence" findings from its own threat intelligence and investigations and advises recipients to enable Lockdown Mode, verify notifications at account.apple.com, and consult a cybersecurity expert 1.

Analysis
Citizen Lab's characterization of the batch as unprecedented in scale and geographic spread carries independent weight from BleepingComputer's separate confirmation with Apple, rather than resting on a single institutional disclosure. Apple's refusal to name the vendor or targeted region leaves attribution dependent entirely on downstream forensic work, and the 110-country footprint points to a broadened set of unrelated operators rather than one concentrated campaign, though the apparent surge could equally reflect greater recipient willingness to disclose notifications rather than any real expansion in targeting volume. The referral pipeline to Citizen Lab and journalists will very likely surface at least one new documented spyware case tied to this batch over the next two months, and confirmation of a specific vendor within that window would give device-security teams grounds to shift from generic threat-notification response toward targeted mitigations.

2 sources

Apple sends new 'Threat Notification' alerts over mercenary spyware attacks - BleepingComputer
Unprecedented Number of Apple Users Received Recent Spyware Alert - Citizen Lab