iPhone owners in 92 countries and the company has not attributed these attacks to specific groups and has not revealed a list of countries where s were alerted. Meanwhile, the iPhone maker has also updated its document with details on how these threat notifications work, along with information for s who might have been targeted by mercenary spyware attacks.
The company has warned s in 92 countries that their iPhone might have been targeted with mercenary spyware. “Apple detected that you are being targeted by a mercenary spyware attack that is trying to remotely compromise the iPhone associated with your Apple ID -xxx-,” the company says in the email sent out to s on April 10 at 12pm PT (12:30am IST on Thursday) viewed by Gadgets 360.
The email informs s asks s to take the warning seriously, adding that that Apple has "high confidence" in the warning — even though it is never possible to achieve absolute certainty when detecting such attacks. Apple's email also states that it has notified s in 150 countries to date, and the company does not attribute these targeted spyware attacks — including those using software like NSO Group — to specific attackers or geographic regions.
Apple has advised s who received the threat notification email to enable Lockdown Mode on their iPhone — a special mode that reduces the avenues for spyware attacks by disabling several features. s are also advised to update to iOS 17.4.1 and keep other devices, messaging, and cloud apps updated. s targeted by mercenary spyware are also advised by Apple to enlist expert guidance.

An example of the threat notification displayed on the Apple ID website
Photo Credit: Apple
The company also updated its document related to threat notifications on Wednesday, explaining how these mercenary spyware attacks work. Once the company detects activity that appears to be consistent with a mercenary attack, it sends an email and iMessage notification to s on their Apple ID-associated email and phone numbers, respectively. s who sign in to the Apple ID website will also see a Threat Notification banner at the top of the page, according to the document.
Apple's threat notifications page also informs s that Apple threat notifications never ask s to click links, open files, install apps, and send their Apple ID or verification code over the phone or via email, to protect them from fraudulent emails pretending to originate from Apple — the latest threat notification doesn't include clickable links and asks s to type in addresses that are separated by spaces.