Apple's August 13, 2025 Spyware Alert: 110 Countries Targeted, Lock Screen Warning, and What to Do Next

The Lock Screen Warning: Exact Text and Design

For the first time, the warning appears as a push notification directly on the iPhone Lock Screen, making it immediate and hard to miss . The alert reads:

"Apple detected a mercenary spyware attack targeted at your iPhone" (or the specific device type) .

Multiple reports describe it as a bright red notification banner that demands attention . This is a significant upgrade from previous waves, where alerts were sent only by email and could sit unread for days.

How Apple Delivers the Alerts

Apple now delivers threat notifications through four channels :

1. Lock Screen push notification — a new addition for this wave, appearing immediately on the device .
2. Settings app — the alert also appears in the Settings app on the device .
3. Email — sent to the email addresses associated with the user's Apple Account .
4. Apple Account notifications — delivered via the user's Apple Account notification system .

This multi-channel approach ensures recipients cannot easily ignore or miss the warning.

Recommended Actions for Targeted Users

Apple advises recipients to take the following steps immediately :

• Enable Lockdown Mode — the company's most extreme security setting, which sharply limits device functionality to block sophisticated attacks. Available since iOS 16, Lockdown Mode is designed to "sharply reduce the attack surface" against highly targeted mercenary spyware .
• Contact the Access Now Digital Security Helpline — Apple directs users to this free, expert helpline for assistance. The helpline can be reached at +1-212-484-9274 or via accessnow.org/help .
• Update all devices to the latest OS version .
• Review Apple's official support document for detailed guidance .

What Apple Says About Certainty and Compromise

Apple characterizes these as high-confidence alerts — the company states it only sends a threat notification when it detects "activity consistent with a mercenary spyware attack" and has high confidence in the detection .

However, Apple also cautions that it cannot guarantee the device was actually compromised. The notification means the user may have been targeted, not that the attack necessarily succeeded . Apple explicitly says it does not attribute the attacks to any specific attackers or geographical regions .

Who Is Typically at Risk

Mercenary spyware like Pegasus and Paragon's Graphite is typically used by governments against high-value, at-risk individuals . This includes:

• Journalists
• Human rights defenders
• Activists and dissidents
• Lawyers
• Political figures
• Other people whose work or profile makes them targets of state-sponsored surveillance

These tools are often deployed in zero-click attacks that can compromise a device without any user interaction .

Why Citizen Lab Calls This a Critical Signal

John Scott-Railton, a senior researcher at the University of Toronto's Citizen Lab, was the first to publicly flag the August 13 wave . He told TechCrunch that the new push-alert delivery method is a significant improvement — because the alert now appears directly on the Lock Screen rather than arriving only by email, which can be missed or ignored for days .

His key observation on the broader significance:

These notifications "create a critical signal that a community is being targeted" — because when a handful of recipients in the same country or profession independently receive alerts, it reveals a coordinated spyware campaign against that group, helping investigators and civil society connect the dots about who is being surveilled and by whom .

Bottom Line

If you receive a red "Apple Threat Notification" on your iPhone Lock Screen, do not ignore it. Enable Lockdown Mode, contact the Access Now Digital Security Helpline, and update your devices. The alert does not necessarily mean your device was compromised, but it is a high-confidence signal that you are being targeted by well-funded, government-grade surveillance.