Apple Expands iPhone Spyware Alerts to Appear Directly on the Lock Screen

Your iPhone’s Lock Screen is about to become a more urgent place to receive bad news. Apple has updated how it delivers its threat notifications, meaning that if the company believes your device has been targeted by mercenary spyware, you’ll now see that warning the moment you pick up your phone — not buried somewhere in a settings menu you’d never normally open.

The change is documented in Apple’s own support guidance and was flagged by TechCrunch, whose post is consistent with Apple’s wording on how these alerts are now displayed. The notification appears both on the Lock Screen and inside the Settings app, giving targeted users two points of contact with what Apple considers a serious security warning.

What Is Apple’s Threat Notification System?

Apple’s threat notification system has been running since 2021, though it hasn’t always worked quite like this. In its earlier form, the company referred to “state-sponsored attackers” in its alert wording. That language has since shifted to “mercenary spyware attacks” — a deliberate choice that reflects the reality of how this kind of surveillance software is actually deployed. It’s not always governments doing the targeting directly. Private companies sell sophisticated spyware tools, and those tools end up in the hands of various actors.

The alerts are not your standard scam warning or phishing flag. They’re a separate category entirely, reserved for people Apple believes may be in the crosshairs of a highly sophisticated, often politically motivated surveillance campaign. Think journalists, lawyers, human rights workers, opposition politicians, or business figures caught up in high-stakes disputes.

Apple is careful about what the notification actually claims. The company says the alert is designed to help users take protective action, not to confirm that a device is definitely compromised. So receiving one doesn’t mean your iPhone has been fully infiltrated — but Apple is saying the pattern of activity it’s detected is serious enough to warrant telling you about it directly.

How Serious Is a Mercenary Spyware Attack?

Very. This isn’t the kind of threat that affects most people on a Tuesday morning. Mercenary spyware — the most well-known example being NSO Group’s Pegasus software — can, in its most advanced forms, gain access to messages, calls, cameras, and microphones without the target doing anything at all. No dodgy link to click, no suspicious attachment to open. Some versions exploit what are known as zero-click vulnerabilities, meaning the attack happens silently.

That’s precisely why Apple’s decision to push these alerts to the Lock Screen matters. If you’re being targeted by this kind of software, you might have no idea. The notification is, in many cases, the only warning you’ll get.

Eva Galperin, Director of Cybersecurity at the Electronic Frontier Foundation, said: “The value of Apple’s threat notifications is that they can reach people who would otherwise have no way of knowing they were being surveilled.”

How Many People Actually Receive These Alerts?

Apple doesn’t publish exact figures on how many people receive these notifications globally. A 2024 wave of alerts reportedly reached users in 92 countries, and a more recent 2026 report claimed the number had grown to 110 countries — but neither figure has been independently verified from an official Apple source, so treat them as indicative rather than confirmed.

What Apple does make clear is that these notifications are sent to a small number of people. This is not a mass-market security feature. It’s a targeted warning system for a small subset of users who Apple’s internal detection systems have flagged as being at elevated risk.

The system is separate from iOS’s broader security architecture, which includes features like Lockdown Mode — a hardened operating state that Apple introduced in 2022 for users who need maximum protection at the cost of some functionality.

What Should You Do If You Receive One?

Apple’s guidance is straightforward: treat it seriously. If you see an Apple Threat Notification on your Lock Screen, the company recommends you contact a specialist organisation. Apple itself points users towards Access Now’s Digital Security Helpline, which offers free technical assistance to civil society members, journalists, and activists who may be targeted by advanced surveillance tools.

You should also consider enabling Lockdown Mode on your device, updating to the latest version of iOS without delay, and, if you’re in a professional context where this kind of targeting is plausible, speaking to your organisation’s security team.

Dismissing the alert or assuming it’s a mistake isn’t advisable. Apple doesn’t send these notifications lightly, and the company has been refining the system for several years to reduce the likelihood of false positives.

What This Means for Kent Residents

For most people in Kent, this kind of alert will never appear on their phone — the system is aimed at a very small number of high-risk individuals worldwide. But journalists, lawyers, political campaigners, or public figures based in the county are exactly the kind of people Apple’s system is designed to protect, and anyone in those categories who does receive one should go straight to Apple’s official support guidance rather than ignoring it. More broadly, the update is a reminder that iOS security notifications are worth reading carefully — Apple distinguishes sharply between routine warnings and these far more serious threat alerts.