Apple warns users in 99 countries of mercenary spyware

Apple has begun sending a new round of threat notifications to victims of suspected mercenary spyware attacks located in nearly 100 countries, with targets including a Turkey-based reporter and a Lebanese documentary filmmaker.

The notification advises victims that alerts were sent to targeted users in 99 countries, according to a screenshot posted to X by threat researcher Costin Raiu, who said he verified the accuracy of several victims’ notifications.

“So far we do not see any signs of compromise in the logs that could confirm which actor is responsible for the breaches,” he said via text.

Apple does not attribute attacks or the notices to specific malicious actors or geographical regions, the notification said, due to the “extreme cost, sophistication, and worldwide nature of mercenary spyware attacks [which] make them some of the most advanced digital threats in existence today.” 

At least two recipients of the threat notifications have so far shared them publicly.

“This is the third Apple Threat Notification I received this year,” Ragıp Soylu, the Turkey bureau chief for the Middle East Eye news outlet, said in an X post Thursday. “Likely state actors using mercenary spyware have repeatedly tried to hack my phone.”

Calling the notification a “badge of honour,” Soylu said he considers the hacks an “endorsement for the reporting I do.”

A second victim, Radwan Mortada, also announced on X that he received a Thursday threat notification warning of targeting with “sophisticated mercenary” spyware.

Mortada is a Lebanese documentary filmmaker, investigative journalist and author known for his reporting on security issues across the Middle East. He has covered the Syrian civil war and Islamic militants, along with other regional security incidents, for several years. 

Adversaries previously targeted his phone with the powerful zero-click Pegasus spyware in 2017 and 2021, he told Recorded Future News via email.

Mortada noted the latest Apple-confirmed attack comes days after the release of an investigative documentary he directed about September 2024 pager explosions in Lebanon. The film, which is available on Qatar-based Al Jazeera 360, focuses on the controversial attacks, which Israel has confirmed it carried out against members of Hezbollah, a Lebanese Shiite militant group and political party.

Following the documentary’s release, he said, Israeli soldiers entered his family home in southern Lebanon, looted it and blew it up with explosives.

While he acknowledged he has no concrete evidence the incident is connected to the latest spyware targeting, he said “the sequence of events, and their timing in relation to my investigative work, raise serious questions that cannot simply be dismissed.”

“What concerns me most is not only my personal safety and privacy, but also the safety of my sources,” he continued. “Surveillance of investigative journalists threatens the confidentiality of those who trust us with sensitive information.”

Apple did not respond to a request for comment and has not yet publicized the notifications on its website.

"Apple Threat Notifications make accountability happen,” John Scott-Railton, a digital forensic researcher at Citizen Lab, said via text. "Apple evolved their notifications in August to be more visible and drive users to take action, and based just on targets coming forwards publicly, it seems to be working."