Apple spyware alerts: what to do if you get one

Apple has operated a system for several years now that sends iPhone users a direct warning when it detects a state-sponsored spyware attack targeting their device. These notifications land right on the lock screen, typically with wording along the lines of "Apple detected a targeted attack against your iPhone." How the system works — and what recipients should actually do when one arrives — has drawn renewed attention from security researchers.

What stands out most about these alerts is just how rarely they're sent. Apple doesn't use this system for run-of-the-mill malware or scam attempts; it activates only when the company detects highly sophisticated spyware campaigns developed by state actors, typically targeting journalists, human rights defenders, opposition politicians, and diplomats. This kind of software is often built by commercial spyware vendors — such as NSO Group, maker of Pegasus — and sold to government clients.

Experts stress that these notifications are almost never false alarms. Apple's threat intelligence teams review the evidence carefully before sending an alert, which means the system errs on the side of caution rather than over-triggering — but it also means anyone who receives one should take it seriously rather than assume it's likely a false positive.

So what should a user actually do the moment they receive one of these notifications? Experts recommend a handful of concrete steps, taken quickly but without panic. The first is to update the device immediately — Apple typically releases security patches in response to these threats, and a device running outdated software remains exposed.

The second important step is enabling Apple's Lockdown Mode. This feature significantly narrows the device's attack surface, disabling entry points spyware frequently exploits, such as message link previews, certain web technologies, and incoming calls or connection requests from unknown contacts. The experience becomes somewhat more restricted, but for people at genuine risk of being targeted, it offers a meaningful extra layer of protection.

Experts also recommend that anyone who receives such a notification reach out to civil society organisations that specialise in digital security. Research groups like Citizen Lab can conduct forensic analysis of a device in these cases, helping identify which spyware was used and, sometimes, where the attack originated. That analysis provides valuable information both for the individual affected and for tracking future threats more broadly.

For the vast majority of people, this is a notification they will never see — the system is designed specifically for people who fit a high-risk target profile. But for those working in journalism, human rights advocacy, or sensitive political work, knowing in advance what these alerts mean and how to respond can save valuable time in a moment of crisis.

Apple's notification system is part of a broader set of measures tech companies have taken against the commercial spyware industry. The company has also filed lawsuits against firms like NSO Group and continuously updates its spyware-detection tooling. Still, security researchers caution that this kind of software keeps evolving, and defensive measures need to evolve alongside it.

Ultimately, the rarity of these notifications doesn't make them any less significant — if anything, it's precisely why they deserve to be taken extremely seriously when one does arrive. The consistent advice from experts: update immediately, consider Lockdown Mode, and seek expert support.