Apple's Threat Notification system detects and alerts users of highly targeted mercenary spyware attacks on iPhones. While the company does not disclose the specific spyware behind each alert, it cites Pegasus as an example historically linked to such attacks. The notifications are high-confidence alerts based on Apple's threat intelligence and forensic investigations. They are sent through multiple channels including email and iMessage, and appear on the user's Apple account page. Apple warns users to verify the authenticity of these alerts and avoid phishing attempts. The attacks are sophisticated, costly, and aimed at a very limited number of individuals. Apple recommends affected users enable Lockdown Mode and consult cybersecurity experts.

The impact is that certain iPhone users, typically high-profile targets, may be subjected to mercenary spyware attacks that compromise their device security and privacy. These attacks are highly sophisticated and expensive, making them difficult to detect and prevent. Receiving a threat notification means Apple has high confidence that the user was individually targeted. However, the vast majority of users are not affected. Apple does not attribute attacks to specific actors or regions, and the notifications do not confirm successful compromise, only targeted attempts.

Apple recommends that users who receive a threat notification take it seriously and enable Lockdown Mode on their devices. Users should verify the authenticity of notifications by checking their Apple account page directly and avoid interacting with suspicious links or requests in emails. Consulting a cybersecurity expert is advised if a user believes they have been targeted. Apple manages detection and notification internally and does not provide specific remediation steps beyond these recommendations.