Apple threat notifications are high-confidence security alerts sent directly to your iPhone, email, and Apple Account page when the company suspects you have been individually targeted by a mercenary spyware attack. These are personal alerts directed at specific individuals whom Apple believes warrant the expense and sophistication of state-sponsored surveillance.
As of mid-August 2026, Apple has notified users in 110 countries suspected of being targeted by such attacks. The company has sent threat notifications multiple times per year since 2021, reaching users across more than 150 countries in total. These are not generic security warnings or mass notifications.
Why Apple Issues These Notifications
Mercenary spyware attacks involve attackers deploying exceptional resources to target a small number of specific individuals, often costing millions of dollars. Attackers typically apply exceptional resources to individuals who warrant it because of who they are or what they do. The attacks are usually attributed to state actors or private companies developing spyware on their behalf, such as Pegasus from the NSO Group. The targets are often journalists, activists, politicians, and diplomats. The vast majority of users will never be targeted by such attacks.
Apple cannot disclose what triggers a threat notification because revealing detection methods would help mercenary spyware developers adapt their tools to evade Apple’s safeguards. Secrecy about the cause protects the integrity of Apple’s detection systems.
How Apple Delivers Threat Notifications
When Apple suspects you are targeted, you will receive notifications through three channels:
- A banner displayed at the top of your Apple Account page after you sign in to account.apple.com
- A notification on your iPhone’s Lock Screen
- An email sent from threat-notifications@email.apple.com to addresses associated with your Apple Account
How to Verify a Threat Notification Is Genuine
Threat notifications can be faked, to confirm Apple actually sent one, sign in to account.apple.com. If a genuine notification exists, it appears as a clear banner at the top of the page immediately after authentication. You can also verify the email address: legitimate notifications come from threat-notifications@email.apple.com.
Legitimate Apple threat notifications never ask you to click links, open files, install apps or profiles, or provide your Apple Account password or verification code by email or phone. If a message asks for any of these, it is a scam.
What to Do If You Receive One
Take the notification seriously, Apple threat notifications recommend enabling Lockdown Mode, a restrictive security setting that limits device functionality to reduce attack surface. The notification itself contains additional guidance tailored to your situation.
Contact the Digital Security Helpline at the nonprofit Access Now, available 24 hours a day, seven days a week. The helpline cannot tell you what caused Apple to send the notification, but operators can provide tailored security advice specific to your circumstances.
If you are a journalist, activist, or public figure, professional digital security support is worth pursuing immediately. Outside organizations and helpline staff do not have access to Apple’s detection data, so they cannot explain why you were targeted. They can, however, help you secure your devices and accounts against ongoing threats.
