Receiving a security warning from Apple is unsettling. Receiving one that says a professional spyware operator may be trying to compromise your iPhone is the digital equivalent of hearing ominous music while walking into an empty room.
On July 10, 2024, Apple sent a new round of threat notifications to selected iPhone users across 98 countries. The messages warned that the recipients may have been individually targeted by a mercenary spyware attack. It was Apple’s second major notification campaign that year, following alerts sent to users in 92 countries in April.
The warning did not mean that every iPhone was suddenly under attack. These operations generally focus on a tiny number of people chosen because of their work, identity, contacts, access, or political influence. However, anyone who receives a genuine Apple threat notification should treat it as a high-priority security incident, not as another message to swipe away between weather alerts and group-chat chaos.
What Did Apple’s Spyware Warning Say?
Apple’s July notification told affected users that the company had detected an attempt to remotely compromise the iPhone associated with their Apple Account. It also explained that the attack was probably directed at them specifically because of who they were or what they did.
Apple did not publicly identify the spyware developer, the operator behind the campaign, or every country in which notifications were received. That silence is deliberate. Revealing the technical signals used to detect an attack could help spyware operators change their methods and become more difficult to catch.
Apple describes its threat notifications as high-confidence alerts. Detection can never provide absolute certainty, but the company says these messages should be taken very seriously. Since launching the notification system in 2021, Apple has sent warnings multiple times each year and has notified targeted users in more than 150 countries.
An alert does not automatically prove infection
A threat notification means Apple found evidence consistent with an attempt to target a particular user. It does not necessarily prove that the attacker successfully installed spyware.
Only a professional forensic investigation can determine whether a device was compromised. Past investigations by Amnesty International, Citizen Lab, Access Now, and other security organizations have confirmed infections in some cases involving recipients of Apple notifications. In other cases, researchers have found evidence of unsuccessful targeting attempts.
What Is Mercenary Spyware?
Mercenary spyware is sophisticated surveillance software developed and sold commercially. Customers are often government agencies, intelligence organizations, law-enforcement bodies, or contractors operating on their behalf.
Unlike ordinary malware, which may be distributed to thousands or millions of people, mercenary spyware is usually customized for a small list of targets. Developing a reliable exploit chain can cost millions of dollars, especially when it depends on previously unknown software vulnerabilities known as zero-days.
Apple previously described these campaigns as “state-sponsored attacks.” In 2024, it adopted the broader term “mercenary spyware” to reflect the role of private companies that create, sell, maintain, and sometimes operate surveillance technology for government customers.
What spyware may access
When a sophisticated spyware infection succeeds, the operator may be able to collect messages, photos, files, contacts, location information, calendar data, and account credentials. Depending on the product and permissions gained, surveillance tools may also access information inside encrypted messaging applications after messages have been decrypted on the phone.
This distinction matters. Strong encryption may protect a message while it travels across the internet, but it cannot fully protect the message if the attacker has already compromised the device displaying it. That is a little like installing the world’s strongest front door while someone is quietly sitting inside the kitchen.
Who Is Most Likely to Be Targeted?
Apple emphasizes that the overwhelming majority of users will never face this kind of attack. Mercenary spyware is expensive, technically demanding, and often useful only until researchers discover the exploited vulnerabilities.
Historically, common targets have included:
- Journalists and editors covering politics, corruption, conflict, or organized crime
- Human-rights defenders, activists, and nonprofit leaders
- Politicians, diplomats, government officials, and campaign personnel
- Lawyers representing politically sensitive clients
- Researchers investigating surveillance companies or security vulnerabilities
- Business executives with access to valuable negotiations or intellectual property
- Relatives, colleagues, and close contacts of higher-profile targets
A person does not need to be internationally famous. Sometimes access is what matters. An attacker may target an assistant, family member, driver, colleague, or local reporter because that person’s phone offers a quieter route to a more prominent objective.
How Can an iPhone Spyware Attack Work?
Zero-click attacks
The most troubling attacks require no action from the victim. A malicious message, media file, call request, or network response may trigger a vulnerability while the operating system processes it. The recipient does not have to click a link, open an attachment, or make an obvious mistake.
Citizen Lab’s investigation of the FORCEDENTRY exploit, for example, documented an iMessage-based zero-click technique used to deliver NSO Group’s Pegasus spyware. Apple patched the associated vulnerability after researchers disclosed it. Later investigations involving Paragon’s Graphite spyware also found evidence of an invisible iMessage zero-click attack against journalists.
One-click and watering-hole attacks
Other campaigns rely on convincing a target to open a malicious link. The message may impersonate a colleague, government office, delivery company, conference organizer, or news source.
Attackers can also compromise a website frequently visited by the intended target. When the target opens the site using a vulnerable phone, hidden code checks the device and delivers an exploit. This technique is called a watering-hole attack because the attacker waits near a digital place the target is expected to visit.
Google’s Threat Analysis Group has documented campaigns in which government-backed operators reused exploits associated with commercial surveillance vendors. Some attacks continued to work because targeted devices had not installed security patches that were already available.
How to Verify an Apple Threat Notification
Spyware warnings create an obvious opportunity for phishing. Criminals can send fake alerts and hope frightened users will click a “security verification” link, install an app, or surrender an Apple Account password.
Apple says an authentic threat notification may appear through email and iMessage, but it will also be displayed after the user signs in directly to account.apple.com. A genuine Apple notification will never ask the recipient to click a link, open an attachment, install an application or configuration profile, or provide a password or verification code by email or telephone.
To verify an alert safely:
- Do not use links contained in the notification.
- Open a new browser window and manually enter account.apple.com.
- Sign in using the normal Apple Account process.
- Look for a threat notification displayed at the top of the account page.
- If no notification appears, contact Apple Support through an official channel before taking further action.
What to Do After Receiving a Genuine Warning
1. Update every Apple device
Install the latest available versions of iOS, iPadOS, macOS, and watchOS. Security updates frequently close vulnerabilities used in targeted attacks, and an unpatched secondary device may become the weakest member of your personal Apple ecosystem.
Do not postpone the update because the battery is at 23 percent and the charger is in another room. This is the moment to make the heroic journey across the house.
2. Enable Lockdown Mode
Lockdown Mode is an optional protection designed for people facing highly sophisticated digital threats. It reduces the attack surface by limiting certain message attachments, web technologies, device connections, wireless behaviors, incoming invitations, and configuration changes.
On an iPhone or iPad, open Settings, choose Privacy & Security, select Lockdown Mode, and follow the prompts to turn it on and restart the device. Apple recommends enabling it on all supported devices belonging to an at-risk user.
Some websites and communication features may work differently while the mode is active. That inconvenience is intentional. Lockdown Mode behaves like a highly suspicious security guard who checks every delivery twice and refuses to let unknown guests wander through the building.
3. Do not immediately erase the phone
A factory reset may destroy valuable forensic evidence without guaranteeing protection from another targeting attempt. Access Now recommends preserving the device and creating a backup rather than rushing to erase it. The best response may vary depending on the victim’s risk, so expert guidance is important.
4. Seek specialized assistance
Journalists, activists, human-rights defenders, and other civil-society members may request support from organizations such as Access Now’s Digital Security Helpline or Amnesty International’s Security Lab. These teams can help preserve evidence, assess exposure, and arrange forensic analysis.
5. Use a separate trusted device for sensitive communication
Until specialists assess the suspected phone, conduct sensitive conversations using another updated device. Avoid discussing the investigation, confidential sources, travel, legal strategy, or account-recovery plans on the potentially affected phone.
6. Protect connected accounts
From a separate trusted device, review important email, cloud, workplace, and social-media accounts. Use unique passwords, enable strong multifactor authentication, and consider hardware security keys for particularly sensitive accounts.
Before making major account changes, consult the forensic team when possible. Sudden changes can alert an attacker or complicate the preservation of useful evidence.
7. Notify the right people carefully
A compromised phone can expose more than its owner. Sources, coworkers, family members, clients, and organizational partners may appear in messages or contact lists. Work with security professionals to determine who needs to be informed and what precautions they should take.
Are Battery Drain and Overheating Proof of Spyware?
No. Battery drain, warmth, slow performance, and crashes can result from ordinary software bugs, aging batteries, background applications, weak cellular signals, or an impressive collection of browser tabs.
Basic spyware may create noticeable symptoms, but advanced mercenary spyware is specifically designed to remain hidden. Apple has disputed claims that common symptoms such as unexpected battery drain or high data use reliably indicate a sophisticated iPhone spyware infection.
Similarly, normal performance does not prove that a phone is clean. A professional forensic examination looks for technical artifacts, unusual logs, malicious infrastructure, crash records, and other indicators that casual observation cannot provide.
What Should Ordinary iPhone Users Do?
People who have not received a threat notification do not need to panic or place every device into Lockdown Mode. Still, the same habits that reduce mercenary spyware risk also improve protection against ordinary account theft and malware.
- Install operating-system and application updates promptly.
- Turn on automatic updates and background security improvements.
- Use a strong device passcode rather than a simple repeated number.
- Enable multifactor authentication for important accounts.
- Avoid unexpected links, attachments, profiles, and application-installation requests.
- Remove unfamiliar devices from account dashboards.
- Back up important information regularly.
- Use Lockdown Mode when personal circumstances create an elevated risk.
Updates deserve special attention. Commercial surveillance companies may spend heavily to discover new vulnerabilities, but previously patched flaws remain useful whenever users continue running old software. Ignoring updates gives expensive spyware a discount coupon.
Why the Mercenary Spyware Industry Is a Wider Problem
The danger extends beyond individual phones. When journalists believe confidential sources may be exposed, sources become less willing to speak. When activists suspect every message is monitored, organizing becomes riskier. When opposition politicians, diplomats, or lawyers are targeted, surveillance can affect elections, negotiations, legal proceedings, and public accountability.
Google has reported tracking dozens of commercial surveillance vendors. Digital-rights organizations argue that the industry’s harm cannot be solved by software patches alone because vendors can change names, reorganize ownership, acquire new exploits, and continue selling similar capabilities.
The United States has used sanctions, export restrictions, and visa policies against organizations and individuals associated with abusive commercial spyware. Apple has also pursued legal action against NSO Group. These measures reflect a growing recognition that mercenary spyware is not merely a technical nuisance; it is a governance, civil-rights, and national-security challenge.
Experience-Based Lessons: Handling the First 24 Hours
The following is a realistic composite incident-response experience based on established security guidance. It does not describe one specific named victim.
The first reaction is usually disbelief
A person receives the notification during an otherwise normal day. The first instinct is to assume it is spam. That reaction is understandable because most security alerts are routine, automated, or dramatically worded advertisements for questionable cleanup applications.
The important experience-based lesson is to replace panic with verification. The recipient does not click anything in the message. They manually visit Apple’s account website and confirm that the warning is genuine. This small pause prevents a real alert from becoming the opening act of a separate phishing attack.
The phone stops being an ordinary phone
Once the alert is verified, the device should be treated as potential evidence. It may still look perfectly normal. Messages arrive, applications open, and the camera continues producing highly detailed photographs of lunch. None of that proves the phone is safe.
The user switches sensitive communication to another updated device. They avoid discussing the alert with confidential contacts on the suspected phone. Instead of immediately wiping it, they preserve it for professional analysis and document when the warning appeared.
Security improvements create inconvenience
Turning on Lockdown Mode may affect websites, attachments, invitations, and device connections. At first, the restrictions can feel excessive. After all, people buy smartphones because they want features, not because they dream of disabling them.
However, the experience quickly reveals an important security principle: convenience and attack surface are often roommates. Every feature that automatically previews content, processes a complex file, or accepts an unexpected connection may offer attackers another opportunity. Lockdown Mode temporarily favors safety over smoothness.
The incident becomes organizational
A targeted phone may contain conversations with coworkers, sources, attorneys, clients, or family members. The user therefore contacts the appropriate security person within their newsroom, company, campaign, nonprofit, or agency.
Good incident response avoids broadcasting unverified claims. The organization identifies which accounts and relationships may have been exposed, protects critical systems, and privately informs affected people when necessary. The goal is not to create a group chat titled “We Have All Been Hacked.” The goal is controlled, evidence-based communication.
The emotional effect can outlast the technical cleanup
People targeted with spyware often describe uncertainty as one of the hardest parts. They may wonder which conversations were accessed, when the targeting began, and whether people around them are also at risk.
A careful response therefore addresses both technology and personal well-being. The user works with trusted experts, limits speculation, records confirmed facts, and avoids repeatedly checking the phone for imaginary signs. Professional assistance turns an invisible and intimidating threat into a series of manageable decisions.
The lasting lesson is preparation
After the immediate incident, the user creates a security plan: regular updates, protected backups, stronger authentication, separate channels for sensitive conversations, and clear emergency contacts. The experience changes cybersecurity from an abstract concern into a routine professional responsibility.
No protection is magical, but preparation removes many easy opportunities. Attackers may arrive with expensive exploits and impressive infrastructure; defenders should not greet them with a four-year-old operating system and the password “password123.”
Conclusion
Apple’s July 2024 mercenary spyware warning was serious but highly targeted. The company notified selected users in 98 countries because it had detected evidence that professional surveillance operators may have tried to remotely compromise their iPhones.
Most iPhone owners are unlikely to face this level of attack. For those who receive a genuine notification, however, the right response is immediate and methodical: verify the alert directly through the Apple Account website, update every device, enable Lockdown Mode, preserve potential evidence, move sensitive conversations elsewhere, and seek qualified forensic support.
The larger lesson is not that iPhones are uniquely unsafe. It is that a profitable global market now exists for tools designed to bypass even well-protected mobile platforms. Software vendors can close vulnerabilities, but reducing abuse will also require independent research, legal accountability, responsible government purchasing, and continued support for the journalists and civil-society groups most frequently placed in the crosshairs.
