Apple Spyware Alert: What to Do If One Appears
Matthew Leo · Published August 17, 2026 · Guides
An Apple threat notification is not a routine phishing warning: it means Apple has high confidence that someone specifically targeted you with mercenary spyware.
Apple sent a new round of alerts on August 13, 2026. The company told TechCrunch that users in 110 countries were included. Apple does not publish a country list, so Canadians should not assume Canada was included or excluded.
The alert does not prove that an iPhone was successfully hacked. It does mean the recipient should verify it independently, reduce further exposure and get expert help. Deleting the email or restarting the phone is not enough.
First, verify the alert without using its email
Apple now shows threat notifications in three places: on the iPhone Lock Screen and in Settings, by email, and as a banner after sign-in. The safest verification path is to open the Apple Account website yourself and sign in there.
Apple's current threat-notification guidance says a real notice never asks you to click a link, open an attachment, install an app or configuration profile, or provide a password or verification code by email or phone.
That rule matters because criminals can copy the language and appearance of a security alert. An alarming email that pushes you toward a login page may be ordinary account theft rather than evidence of advanced spyware. Verify through the address you entered yourself before taking instructions from the message.
A safe four-step response
Verify: open the Apple Account website yourself and look for the signed-in warning. This avoids a fake alert's links and attachments.
Reduce exposure: update devices and enable Lockdown Mode to limit features advanced spyware can target.
Preserve evidence: contact a qualified security team before wiping the phone because a reset can remove clues investigators need.
Secure accounts: review devices, recovery details and passwords from a trusted device to address connected account risk.
Targeted does not always mean compromised
Apple describes these alerts as high-confidence warnings that a person was individually targeted. The company does not reveal the technical signal that triggered a notice because that could help attackers change their methods.
A target may have received a malicious message, link or attack attempt without the spyware succeeding. Another device or account could still be involved. That is why the right response is neither panic nor dismissal. Treat the alert as evidence that a capable attacker chose you, then preserve the chance for qualified investigators to understand what happened.
Most people will never receive one. Mercenary spyware is expensive and is commonly aimed at journalists, activists, politicians, diplomats and others whose communications are valuable. The rarity of the alert is one reason it deserves attention.
Turn on Lockdown Mode after updating
Apple recommends updating affected devices and enabling Lockdown Mode. On an iPhone or iPad, open Settings, choose Privacy & Security, scroll to Lockdown Mode and follow the restart prompt. On a Mac, the control is under System Settings, then Privacy & Security.
Lockdown Mode reduces the features an attacker can reach. It limits many message attachments and link previews, blocks some complex web technologies, restricts unexpected FaceTime calls and invitations, tightens wired accessory access and prevents configuration profiles from being installed.
Those restrictions can make websites and sharing features work differently. That inconvenience is intentional. Lockdown Mode is an extreme option for people facing unusually sophisticated attacks, not a setting every iPhone owner needs to use.
Turn it on separately for each supported iPhone, iPad and Mac. A paired Apple Watch follows the iPhone setting, but the other devices do not automatically inherit it.
Get expert help before wiping everything
Apple points recipients to the nonprofit Access Now Digital Security Helpline. The helpline supports at-risk people and can help build a response around the person's work, accounts and devices.
Contacting an expert before a factory reset can be important. A reset may reduce some immediate risk, but it can also remove evidence that helps identify the attack. Do not send sensitive screenshots, device backups or logs to an unfamiliar person who contacts you first. Start from Apple's support page or Access Now's official website.
If the device belongs to an employer, newsroom, political office or advocacy group, follow its incident process and tell the security team. The alert may point to risk for colleagues and sources, not just the phone owner.
Secure the account and connected devices
After preserving evidence and getting advice, review the Apple Account from a trusted device. Check the signed-in device list, trusted phone numbers and account-recovery information. Remove anything you do not recognize, change the password and confirm that two-factor authentication is active.
Do not assume a password change alone removes spyware from a device. Account theft and device exploitation are different problems, although they can happen together. An attacker with device access may see new credentials, while an attacker who only stole a password may be stopped by a secure change and stronger recovery settings.
Update every Apple device you use, not only the one that displayed the notification. Also update communication apps and browsers. If you must keep working during the response, move the most sensitive conversations to a clean device after an expert helps you decide what “clean” means in your situation.
Mapletechie's practical guides cover broader account, phone and privacy checks. They are useful for ordinary security hygiene, but a verified Apple threat notification needs the higher level of care described here.
Everyone else should focus on ordinary protections
If you did not receive a verified alert and have no reason to believe you face a targeted attack, do not install “spyware cleaner” apps advertised through pop-ups. Keep software current, use a strong device passcode, protect the Apple Account with two-factor authentication, turn on Stolen Device Protection and avoid unknown links or profiles.
The new alert design makes a rare warning easier to see. The safest response remains simple: verify it at Apple's site, reduce the attack surface, and involve people who handle targeted digital threats for a living.