An Apple threat notification is a security alert sent by Apple to users who have been targeted by state-sponsored or mercenary spyware. These notifications are designed to warn high-risk individuals—such as journalists, activists, and government officials—that their devices have been compromised by sophisticated software, like the Pegasus spyware.
Since 2021, Apple has sent these notifications to users in over 150 countries, according to company support documentation. Because these alerts are rare and involve high-stakes security threats, it is critical to distinguish authentic warnings from phishing attempts designed to steal your credentials.
A legitimate Apple threat notification will appear in two specific places: as a banner at the top of your Apple Account dashboard (account.apple.com) and as a notification within your iPhone’s Settings menu. If you receive an email or text message claiming to be a threat alert, you must verify it through these official channels before clicking any links.
Apple’s official communication process is designed to be verifiable. Scammers often use urgency and malicious links to trick you into providing your Apple ID password or other sensitive data. Official notifications from Apple will never ask you to click a link to log in, download a file, or provide your credentials directly through a message.
To confirm if a notification is authentic, you should ignore any links provided in an email or SMS and navigate directly to your device settings. If Apple has issued a warning, it will be visible in the following locations:
- Open the Settings app on your iPhone. If a notification is active, an "Apple Threat Notification" menu will appear directly below your Apple ID profile banner at the top of the screen.
- Navigate to account.apple.com in a web browser. Log in with your Apple ID and password. If a notification has been sent to you, a banner labeled "Threat Notification" will be displayed at the top of the page with further instructions.
If you see no such banner in your account dashboard or no menu in your Settings app, the alert you received is likely a phishing scam.
Keep exploring
More from GroundworkPhishing attempts are designed to mimic the urgency of official security alerts to provoke a quick, emotional response. You should treat any notification as fraudulent if it exhibits any of the following characteristics:
- You are asked to click a link: Official Apple alerts do not require you to click a link to "verify" your account or "secure" your device.
- You are asked to download software: Apple will not ask you to install an app or profile to "remove" spyware.
- The sender is suspicious: While Apple uses
[email protected], scammers can easily spoof email addresses. Never rely on the sender's display name alone.
- The request asks for credentials: Apple will never ask you to provide your password or two-factor authentication code via email or text.
If you receive a suspicious message, do not interact with it. Instead, forward the email to [email protected] to help Apple track and mitigate these fraudulent campaigns.
If you have verified through your Settings or account dashboard that an alert is legitimate, you are likely the target of a sophisticated, state-sponsored attack. You should take immediate steps to increase your device's security profile.
- Enable Lockdown Mode: Go to Settings > Privacy & Security > Lockdown Mode and turn it on. This feature restricts specific iPhone functionalities—such as blocking certain message attachments and preventing incoming FaceTime calls from unknown numbers—to reduce the attack surface for spyware.
- Update your software: Ensure your iPhone is running the latest version of iOS to receive the most recent security patches.
- Seek expert guidance: If you are a high-risk individual, consider contacting organizations like the Access Now Digital Security Helpline, which provides 24/7 support for activists and journalists facing digital threats.
- Change your passwords: Update your Apple ID password and any other critical account passwords from a different, "clean" device if possible.
By following these steps, you minimize the risk of unauthorized access while ensuring you do not fall victim to secondary phishing attacks disguised as security alerts.
