Apple Tells Users in 99 Countries They May Be Targets of Mercenary Spyware

Apple has sent out another round of its threat notifications, warning users in 99 countries that they may have been targeted by mercenary spyware. Among those who've come forward publicly: a Turkey-based news bureau chief and a Lebanese documentary filmmaker whose recent film examined the 2024 pager explosions tied to Hezbollah.

The alert, a screenshot of which was posted to X by threat researcher Costin Raiu, tells recipients they were targeted as part of an attack spanning dozens of countries. Raiu said he verified the authenticity of several of the notifications but couldn't pin down who's behind the campaign. "So far we do not see any signs of compromise in the logs that could confirm which actor is responsible for the breaches," he told The Record.

That ambiguity is by design. Apple's notifications never name a specific attacker or region, something the company attributes to just how expensive, technically advanced, and globally distributed mercenary spyware operations have become. In the company's own description, cited by The Record, these tools rank among "some of the most advanced digital threats in existence today."

Mercenary spyware refers to surveillance software sold by private vendors, often to governments, that can infiltrate a phone and extract messages, location data, calls and more, frequently without the target ever clicking a link. Pegasus, made by Israeli firm NSO Group, is the best-known example, but it's far from the only one on the market.

Two targets step forward

Ragıp Soylu, the Turkey bureau chief for Middle East Eye, said on X Thursday that this marks the third Apple threat notification he's received this year. "Likely state actors using mercenary spyware have repeatedly tried to hack my phone," he wrote, adding that he views the repeated targeting as a "badge of honour" and essentially an "endorsement for the reporting I do."

Radwan Mortada, a Lebanese documentary filmmaker, investigative journalist and author, also posted that he'd received a Thursday notification warning him of "sophisticated mercenary" spyware activity. Mortada has spent years covering security crises across the Middle East, including the Syrian civil war and militant groups operating in the region. This isn't his first brush with spyware: he told Recorded Future News that his phone was targeted with Pegasus in both 2017 and 2021.

What makes this latest notification notable is its timing. It landed just days after the release of a documentary Mortada directed on the September 2024 pager explosions in Lebanon, a wave of attacks that detonated devices carried by Hezbollah members. Israel has confirmed it carried out those attacks. The film is streaming on Al Jazeera 360, the network's platform based in Qatar.

Mortada said that after the documentary came out, Israeli soldiers entered his family's home in southern Lebanon, looted it, and destroyed it with explosives. He was careful to note he has no hard proof linking that incident to the spyware alert. But he said the pattern is hard to ignore: "the sequence of events, and their timing in relation to my investigative work, raise serious questions that cannot simply be dismissed."

His concern extends beyond his own safety. "What concerns me most is not only my personal safety and privacy, but also the safety of my sources," he said. "Surveillance of investigative journalists threatens the confidentiality of those who trust us with sensitive information."

Why Apple's alerts matter

Apple hasn't responded to a request for comment on this round of notifications, and as of now the company hasn't published anything about them on its own site. The notifications themselves have existed for years, but Apple reworked them in August to make them more prominent and push recipients toward actually doing something about the threat.

That redesign appears to be paying off, according to John Scott-Railton, a digital forensic researcher at Citizen Lab, a group that has tracked spyware abuses for years. "Apple Threat Notifications make accountability happen," he said. "Apple evolved their notifications in August to be more visible and drive users to take action, and based just on targets coming forwards publicly, it seems to be working."

That's really the throughline here: Apple isn't naming names, and it may never have enough forensic evidence to do so with confidence. But by flagging potential targets at scale, across nearly 100 countries at once, the company is giving journalists, dissidents and other at-risk individuals something they didn't reliably have before, a signal that someone with serious resources is trying to get into their phone. What happens after that signal lands is still up to the people who receive it, and in cases like Mortada's, the stakes go well beyond one person's device.