Apple is notifying users across approximately 100 countries of targeted attacks by advanced mercenary spyware, with documented victims including journalists and filmmakers working on sensitive regional security stories. The alerts have reached individuals in 99 countries, as confirmed by threat researcher Costin Raiu through screenshots shared on X, who verified the authenticity of multiple recipients' notifications.
Raiu noted that "So far we do not see any signs of compromise in the logs that could confirm which actor is responsible for the breaches." Apple's notification itself refrains from naming specific threat actors or attributing campaigns to particular nations, citing the "extreme cost, sophistication, and worldwide nature of mercenary spyware attacks [which] make them some of the most advanced digital threats in existence today."
At least two individuals targeted in these campaigns have publicly disclosed their notifications. Ragıp Soylu, Turkey bureau chief for Middle East Eye, announced on X Thursday that he had received his third Apple Threat Notification this year. He characterized the alert as a "badge of honour" and stated that "Likely state actors using mercenary spyware have repeatedly tried to hack my phone," attributing the targeting to his journalistic work.
Radwan Mortada, a Lebanese documentary filmmaker, investigative journalist and author specializing in Middle Eastern security reporting, also disclosed receiving a Thursday threat notification warning of "sophisticated mercenary" spyware targeting. Mortada's previous reporting has covered the Syrian civil war, Islamic militant organizations and other regional security developments spanning several years.
Mortada revealed that adversaries had previously compromised his device using the zero-click Pegasus spyware in both 2017 and 2021. The latest Apple-confirmed attack surfaced shortly after Mortada released an investigative documentary examining the September 2024 pager explosions in Lebanon, a film distributed through Qatar-based Al Jazeera 360 that examines the controversial strikes, which Israel has acknowledged conducting against Hezbollah operatives.
Following the documentary's premiere, Israeli soldiers entered Mortada's family residence in southern Lebanon, removed belongings and destroyed the structure using explosives, he reported. Though Mortada acknowledged lacking definitive proof linking this incident to the spyware campaign, he stated that "the sequence of events, and their timing in relation to my investigative work, raise serious questions that cannot simply be dismissed."
Mortada emphasized his concern extends beyond personal security: "What concerns me most is not only my personal safety and privacy, but also the safety of my sources. Surveillance of investigative journalists threatens the confidentiality of those who trust us with sensitive information."
Apple declined to comment on the notifications and has not yet announced them through official channels. Digital forensic researcher John Scott-Railton from Citizen Lab stated that "Apple Threat Notifications make accountability happen. Apple evolved their notifications in August to be more visible and drive users to take action, and based just on targets coming forwards publicly, it seems to be working."
