Apple’s support page on threat notifications says the company has notified targeted iPhone users in more than 150 countries since 2021. The page, last published August 13, 2026, describes a narrow system built for a small number of people facing state-linked mercenary spyware, not a general malware warning for everyday users.
Apple’s own document lays out exactly how the alert reaches someone, what it looks like, and where to check that it is genuine. None of it involves naming an attacker or a spyware maker.
Key facts on Apple’s threat notification page
| Item | What Apple’s page says |
|---|---|
| Document | About Apple threat notifications and protecting against mercenary spyware |
| Support article | support.apple.com/en-us/102174 |
| Last published | August 13, 2026 |
| Countries notified since 2021 | More than 150 |
| On-device alert | Lock Screen and Settings, added in 2026 |
| Email sender | [email protected] |
| Account page | Banner at the top of account.apple.com after sign-in |
| Named support resource | Digital Security Helpline at the nonprofit Access Now |
How a notification actually reaches someone
Apple’s page names three separate channels, and describes them as independent of one another so a person can cross-check one against another:
Don’t miss the best of The Mac Observer
Set us as a preferred source and our Apple reporting ranks higher in your Google Search results and Discover feed — one tap, no account changes.
- An alert on the Lock Screen and in Settings on the affected iPhone.
- An email sent from [email protected] to every address tied to the person’s Apple Account.
- A banner across the top of the person’s own page at account.apple.com once they sign in.
Apple calls these “high-confidence alerts” and states plainly that a genuine one “should be taken very seriously.” The company adds that anyone can confirm a notification is real by signing into account.apple.com directly, where it says a live alert is “clearly visible at the top of the page.”
What changed in 2026, in Apple’s own wording
Apple’s document draws a line at this year. Its own sentence reads: “As of 2026, we notify targeted users directly on iPhone and via email sent from Apple Threat Notifications.” Read against the rest of the page, that means the Lock Screen and Settings alert is the new piece; email and the account page banner are the older mechanism, in place since Apple began this program in 2021.
A threat notification against a routine security update
| A threat notification | A routine security update | |
|---|---|---|
| Who receives it | One targeted individual | Every device on the release’s device list |
| Delivered through | Lock Screen, email, account page | The software update mechanism |
| Apple’s own index | Not listed on support.apple.com/en-us/100100 | Listed on support.apple.com/en-us/100100 |
| Apple’s description | “High-confidence alert” of individual targeting | A documented, patched CVE |
What Apple tells a targeted person to do next
Beyond checking account.apple.com, Apple’s page points to the Digital Security Helpline run by the nonprofit Access Now for people who need emergency assistance. Apple credits that organization by name rather than describing its own internal process for helping a targeted user, and it does not publish a count of how many notifications go out in a given year or in a given country.
The mechanism runs on whatever software a person already has installed. Apple’s iPhone 18 Pro, announced alongside iPhone Duo at the September 9 event, and Apple Watch Series 12, covered in Apple’s own release, are unconnected to this system; neither changes how a threat notification is delivered.
What Apple has not said
Apple has not published a yearly total of notifications sent, has not named any spyware maker on this page, and has not said whether the Lock Screen alert added this year has changed how quickly targeted people respond. It also has not tied this system to iOS 27, which is a routine software update rather than a security alert mechanism.
As of Sunday, September 13, 2026, Apple’s threat notification page carries no revision dated after August 13, and the company’s security releases index lists nothing that names a threat notification event directly. Anyone who wants to check a notification against Apple’s own description can do so at account.apple.com before iOS 27 arrives Monday; Apple’s September 9 event introduced the iPhone 18 Pro and Apple Watch Series 12, both separate from this mechanism.
