Apple Threat Notification Sent to 99 Countries: What It Means and What to Do
Apple has sent a new round of threat notifications to targeted users in 99 countries. Here is how to verify a real alert, turn on Lockdown Mode and get expert help.
Image: TeQBlogs
Apple has sent a new Apple threat notification round to targeted users in 99 countries, according to the notice text shared on 30 October 2026. If you get one, Apple says to treat it seriously: turn on Lockdown Mode, update your devices and get expert help. Most people will never receive this alert, and a genuine one never asks you to click a link or share a password.
Quick summary
- What happened: A fresh batch of Apple threat notifications went out on 30 October 2026 to users in 99 countries, reportedly tied to active mercenary spyware campaigns.
- Who gets them: A small number of people Apple believes were individually targeted, not ordinary users.
- Where it appears: On the iPhone Lock Screen and in Settings, by email from threat-notifications@email.apple.com, and as a banner at account.apple.com.
- What to do: Verify the alert at account.apple.com, turn on Lockdown Mode, update all devices and contact a digital security helpline.
- Total reach: Apple says it has notified users in more than 150 countries since 2021.
What is an Apple threat notification?
An Apple threat notification is a warning Apple sends when it believes a person may have been individually targeted by mercenary spyware. Apple calls these “high-confidence alerts” and says this kind of spyware is far more sophisticated than everyday cybercrime.
Also read: Binance Hack 2026: What the $6.3 Billion Theft Means for Indian Users
Such attacks are rare and expensive. They usually aim at a small group of people, such as journalists, activists, lawyers or business leaders, because of who they are or what they do. Apple has sent these alerts since 2021 and does not say which attackers or regions are behind any batch.
What is new in the October 2026 round?
The new round reached targeted users in 99 countries, according to the notice text posted publicly by a security researcher. Apple had not issued a separate press statement at the time of writing, and its support page still carried a 13 August 2026 date.
The previous major round in August 2026 reportedly reached users in 110 countries. Apple does not publish a country list, so it is not known which countries, including India, were part of this batch. TeQBlogs could not confirm the number of people who received an alert.
| Detail | What we know |
|---|---|
| Date sent | 30 October 2026 (reportedly) |
| Countries in this round | 99 (per the notice text) |
| Previous round | August 2026, reportedly 110 countries |
| Countries notified since 2021 | More than 150 (Apple) |
| Attackers named | None – Apple does not attribute |
| Country list | Not published |
How to check if an Apple threat notification is real
The safest check is to sign in at account.apple.com yourself, by typing the address into your browser. Apple says a genuine notification is clearly visible at the top of that page after you sign in.
Scammers copy security warnings, so look for these signs:
- Real alerts never ask you to click a link, open a file, or install an app or profile.
- Real alerts never ask for your Apple Account password or a verification code, by email or by phone.
- Real emails come from threat-notifications@email.apple.com, and the same alert also shows on the iPhone Lock Screen, in Settings and at account.apple.com.
- If a message pushes you to act fast through a link, treat it as phishing and delete it.
We covered a similar check for official Apple bulletins in our CERT-In Apple advisory guide, which explains how to confirm an update notice before acting on it.
What to do if you get an Apple threat notification
Apple recommends three steps: turn on Lockdown Mode, keep every device updated, and get help from security experts. Do them in this order.
- Verify the alert at account.apple.com, as described above.
- Update your iPhone, iPad and Mac to the latest software in Settings > General > Software Update (on Mac: System Settings > General > Software Update).
- Turn on Lockdown Mode on every Apple device you use (steps below).
- Contact the Access Now Digital Security Helpline. Apple strongly suggests it. The helpline is free, works 24/7, and says it replies within two hours; it mainly serves journalists, activists, human rights defenders and civil society groups.
- Share what you know with the experts. Apple says outside organisations cannot see what triggered its alert, but they can give advice tailored to your situation.
- Tell your organisation’s IT team if you use the phone or Mac for work, so they can review accounts and access.
How to turn on Lockdown Mode
Lockdown Mode is an optional, extreme protection setting that blocks many features attackers abuse. It needs iOS 16, iPadOS 16, watchOS 10 or macOS Ventura or later, and it must be turned on separately on each device.
On iPhone or iPad:
- Open Settings > Privacy & Security.
- Scroll down and tap Lockdown Mode, then Turn On Lockdown Mode.
- Tap Turn On & Restart and enter your passcode.
On Mac:
- Open the Apple menu > System Settings > Privacy & Security.
- Find Lockdown Mode and click Turn On.
- Click Turn On & Restart; you may need your user password.
Turning it on for iPhone also enables it on a paired Apple Watch.
What Lockdown Mode changes on your iPhone
Lockdown Mode trades convenience for safety, so some apps and websites will feel different. Phone calls, plain text messages and emergency SOS still work.
| Area | What changes |
|---|---|
| Messages | Most attachment types are blocked, except some images, video and audio; links and link previews are unavailable |
| Web browsing | Some complex web technologies are blocked, so certain sites may load slowly or break |
| FaceTime | Incoming calls are blocked unless you called that contact in the last 30 days |
| Photos | Location data is removed from shared photos; shared albums are removed |
| Wired connections | iPhone must be unlocked to connect to accessories or computers |
| Wi-Fi and cellular | No auto-join to non-secure Wi-Fi; 2G and 3G support is turned off |
| Profiles and MDM | Configuration profiles cannot be installed and the device cannot enrol in device management |
You can exclude trusted websites in Safari and some apps, but Apple warns that every exclusion reduces protection. With iOS 27, iPadOS 27 or macOS 27 and later, you can also add trusted contacts so messaging limits are lifted for them.
Should everyone turn on Lockdown Mode?
No. Apple says the vast majority of users will never be targeted by this kind of attack. Lockdown Mode is meant for people who have good reason to believe they are at risk, even if they have not received an alert.
For everyone else, Apple’s standard advice is enough: use a passcode with Face ID or Touch ID, turn on two-factor authentication, enable Stolen Device Protection, install apps only from the App Store, use strong unique passwords or passkeys, and avoid links from unknown senders. Our crypto exchange account security guide walks through the same habits for financial apps. Businesses that hand out iPhones and MacBooks can also review device policies with a managed cybersecurity partner.
Not receiving an alert does not prove a device is clean. Security researchers note that some attacks are never detected, which is why updates and good habits matter for everyone. For a wider view of how state-linked groups now use AI tools, see our report on AI-assisted hacking campaigns.
Frequently asked questions
Is an Apple threat notification a scam?
A genuine one is not, but fake versions exist. Sign in at account.apple.com yourself; a real alert appears as a banner at the top of the page, and Apple never asks for passwords, codes or link clicks in these alerts.
Did Indian users get the October 2026 Apple threat notification?
Apple does not publish which countries were included in any round. With 99 countries in this batch, it is possible, but it cannot be confirmed from official information.
Does Lockdown Mode slow down my iPhone?
It does not slow the phone itself, but some websites may load slowly or look broken because complex web features are blocked. Messages, FaceTime and sharing features are also restricted.
What should I do if I did not get an alert but feel targeted?
Apple says you can turn on Lockdown Mode anyway if you have good reason to believe you are at risk. Keep all devices updated and consider contacting a digital security helpline for advice.
Bottom line
The October 2026 Apple threat notification round is a reminder that mercenary spyware is real but narrowly targeted. If you receive an alert, verify it at account.apple.com, update, turn on Lockdown Mode and get expert help. If you did not, keep your devices updated and ignore any “Apple security alert” that asks you to click a link.
Sources
- About Apple threat notifications and protecting against mercenary spyware – Apple Support
- About Lockdown Mode – Apple Support
- Digital Security Helpline – Access Now
About The Author
