Apple spyware alerts reached users in 110 countries

A new batch of Apple warnings drew a record response from investigators, who say the reports may reflect both wider targeting and more visible alerts.

Apple has sent out a new wave of spyware threat notifications, and investigators say the number of people receiving them appears to be the largest yet. The alerts, delivered on Friday, warned customers in 110 countries that their devices may have been targeted with powerful spyware. For many users, it was more than a routine security notice — it was a sign that highly targeted digital attacks may be reaching a broader and more visible audience.

The scale of the latest batch has drawn attention not just because of how many people were notified, but also because of who appears to be affected. Among those who publicly reported receiving the warning was a soldier in the Ukraine Armed Forces, who said he first thought the alert was a scam before checking it with Apple. He also said he knew of other people in Ukraine’s military who had received the same notification.

Apple’s latest warnings triggered an unusually large response

Apple regularly sends these notifications when it believes a user may have been targeted or compromised by what it calls “mercenary spyware” — malware often associated with government use. The company has said that over the past few years it has alerted people in more than 150 countries.

This latest round stood out because of its apparent size. One digital rights group that Apple recommends victims contact for help said the batch looked to be the biggest so far. Mohammed Al-Maskati, who leads the Access Now team that investigates reports through its helpline, told TechCrunch that the group received a record number of requests after Friday’s alerts went out.

According to Al-Maskati, the volume was about 30% to 40% higher than what the nonprofit usually sees after Apple sends a new batch of notifications. Cybersecurity firm iVerify also told TechCrunch that it was seeing an influx of Apple threat notifications. As IT-PUB News points out, the alerts in this batch reached users across 110 countries.

Investigators say the alerts may reflect a broader threat

The unusually high number of reports has raised concern among researchers who track spyware campaigns. John Scott-Railton, a senior researcher at The Citizen Lab, said the public reports suggest spyware attacks may be more common than many people realize.

He said the scale and geographic spread of the public posts were “pretty unprecedented,” and argued that every public notification likely represents a much larger number of cases that never become visible. In his view, the alerts point to “something bigger” happening.

At the same time, both Scott-Railton and Al-Maskati said Apple’s newer alert system may also be contributing to the spike in reports. Starting this year, Apple notifies users in several places: on the iPhone lock screen, in the Settings app, by email linked to the Apple account, and when users log in to their Apple Account on the web.

Al-Maskati said the new approach has made the warnings harder to miss and has increased awareness of how serious they are.

Reports tied to Ukraine put real people behind the warnings

Reports from Ukraine have added a more personal dimension to the latest wave of alerts. The soldier who spoke to TechCrunch said the notification caught him off guard, and he was also aware of other members of Ukraine’s military receiving the same message. He said some of them were worried.

The Computer Emergency Response Team of Ukraine did not respond to TechCrunch’s request for comment on whether it knew of other Ukrainians, including soldiers, receiving similar alerts. Apple also did not respond to the outlet’s request for comment.

The reports do not confirm who was behind the spyware attempts or who was specifically targeted. Still, they show why these alerts draw attention far beyond the tech world. Spyware warnings can affect people working in sensitive areas, including journalism, activism, and conflict-related environments, where a compromised phone can expose private communications and contacts.

Apple says users should not ignore a spyware warning

Apple and the investigators it directs users to say the notifications should be taken seriously. People who receive them are advised to investigate the warning rather than dismiss it as a scam.

Apple also recommends turning on Lockdown Mode, a security feature designed to make iPhones, iPads, and Mac computers harder to hack. The company has said it is not aware of anyone being hacked while Lockdown Mode was enabled.

For users, the practical concern is straightforward. These alerts are not about ordinary spam or a routine app warning. They are meant for cases where a device may have been singled out by advanced spyware tools. For businesses and organizations, especially those handling sensitive information, the latest wave is another reminder that personal devices can become an entry point into private conversations and professional data.

The latest reports also show the trade-off that comes with stronger security alerts. More visible warnings can help people react faster, but they can also make the scale of the threat feel much more immediate. In this case, investigators say the volume of reports is a key part of the story.