"The extreme cost, sophistication, and worldwide nature of mercenary spyware attacks make them some of the most advanced digital threats in existence today. As a result, Apple does not attribute the attacks or the notice you’re receiving to any specific attackers or geographical regions," Apple said.
Apple’s global notification claim
Apple said it is sending a fresh round of notifications to people whose devices the company believes were targeted by commercial, or “mercenary,” spyware. The company stated the current notification wave reaches "targeted users in 99 countries, and to date we have notified users in over 150 countries in total." Apple also clarified that it does not attribute the notices to specific attackers or geographic regions.
Apple did not immediately respond to a request for comment Friday about which countries were targeted in the latest batch.
Who received warnings: journalists, filmmakers and others
The company noted recipients include journalists and documentary filmmakers. Researchers and groups that work on spyware described the notifications as significant, and the notices themselves commonly prompt victims to seek further help. "The notifications frequently lead to victims approaching Access Now, The Citizen Lab and other groups seeking further assistance and prompting deeper investigations," the reporting said.
Apple sent its last major batch of notifications in August, and the new set extends a pattern of periodic alerts the company has issued when it identifies suspected targeting consistent with commercial spyware tradecraft.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleResearchers and rights groups respond
John Scott‑Railton, senior researcher at The Citizen Lab at the University of Toronto, described the notifications as "an important set of notifications with a bunch of cases, based purely on what we see publicly," and he posted on social media about how potential victims could defend themselves. Scott‑Railton warned people to be cautious about companies that offer paid solutions to spyware infections and cautioned that the lack of a notification does not rule out an infection.
Natalia Krapiva, senior tech‑legal counsel with Access Now, framed the notices as a reminder that "the fight against the scourge of spyware abuse is far from over." Krapiva said that while Access Now and companies like Apple have increased capacity to investigate and notify, "repressive states continue to use these powerful surveillance technologies, including against civil society actors and opposition figures."
Technical guidance Apple and researchers recommend
According to the reporting, Scott‑Railton seconded Apple’s recommended immediate steps for those who receive a notification: enable Lockdown Mode and get in touch with the digital rights group Access Now. He also advised caution around commercial remediation services, pointing out the potential risks of paid solutions that advertise spyware removal.
Scott‑Railton additionally warned that absence of a notification should not be read as confirmation of safety: an infection can remain undetected, he said, underscoring the ongoing uncertainty victims face even after company outreach.
What this means for journalists, Access Now, and Pall Mall negotiators
- Journalists and documentary filmmakers: they are explicitly named among recipients and may be among those seeking technical and legal assistance after receiving notices.
- Access Now and The Citizen Lab: the notifications "frequently lead to victims approaching" these groups, increasing demand for investigation and victim support, and reinforcing the roles the organizations already play in post‑notification response.
- Pall Mall Process negotiators and states: the notices arrive "shortly before the final rounds of negotiations over industry standards for commercial hacking tools being developed under the voluntary Pall Mall Process." Krapiva argued that "the spyware industry must face some real consequences for the uncontrolled sale of these tools and refusal to curb the abuses," and said states considering adoption of the guidelines "must come to terms that the current system is not working."
The new wave of Apple notifications reinforces a policy and operational moment: private-sector detection and victim notification persist as key mitigations, civil-society groups continue to be primary receivers of follow-on cases, and international standards talks — here, the Pall Mall Process final rounds — are unfolding alongside fresh evidence of persistent abuse. Apple’s decision not to attribute attacks in its notices leaves open questions about the origins and operators behind specific intrusions, while the steady cadence of alerts underlines that spyware remains an active threat vector for at least some journalists, filmmakers and civil‑society actors.
