A warning from Apple: what a threat notification means, and what Lockdown Mode promises

What the notice says and how it arrives

Apple says it has sent threat notifications since 2021, several times a year, and has notified users in over 150 countries in total[S1]. On 13 August 2026 it told BleepingComputer it had sent a new batch to users in 110 countries; the change this time was a Lock Screen push notification with clearer next steps[S2]. The notice also arrives by email and as a banner at the top of the Apple Account page after sign-in[S1].

Apple says a real notice never asks the recipient to click a link, open a file, install an app or profile, or enter a password or code [S1][S2]. It recommends enabling Lockdown Mode and contacting the Digital Security Helpline run by Access Now, which Apple describes as staffed around the clock[S1].

What Apple does not say

Apple does not say who attacked, which vendor’s product was used, what triggered the alert or how many users received it. It does not attribute attacks to governments or regions [S1][S3]. It describes the notices as high-confidence but not certain, and says the vast majority of users will never be targeted[S1].

The numbers are easy to misread. The 150 is cumulative over five years and the 110 is one wave[S1]. Both count countries. Neither is a count of victims, and neither is a rate for the general public.

Two professional positions

Apple’s own position is that a notification reflects high confidence of targeting, not certainty of compromise[S1]. Citizen Lab, which has examined notified phones, advises that a notification be treated as presumed compromise and that at-risk people enable Lockdown Mode[S5]. The two statements are compatible. One describes what Apple can know from its own signals; the other is a prudent response for someone who may be a target.

The Serbian cases show both outcomes. In September 2026 Citizen Lab reported that a member of a student protest movement who had received a notification was in fact infected with Pegasus, and that at least 14 people in the movement, civil society and an opposition party had received notices[S5]. In October it reported a second person who got notifications on 13 and 27 August 2026 whose infection was not confirmed[S6]. A notice was a good reason to investigate in both cases. In only one did the investigation confirm infection.

Fake alerts

Criminals imitate official warnings, which is why Apple’s list of what a real notice never asks matters. Figure 2 turns that list into a path. It checks a message; it does not check a phone.

The difficulty is verification. Apple’s alert is built from its own signals, which it will not describe, so an owner cannot check them. What an owner can check is the route the message took. A Lock Screen alert and an email that match a banner on the account page, reached by typing the address, form a consistent picture. A message that arrives alone, in a text or an unfamiliar email, and asks for a click, is the wrong shape however convincing its wording.

Apple’s own page also lists Stolen Device Protection among the steps it recommends alongside Lockdown Mode[S1]. It is a reminder that a targeted-attack warning and ordinary phone security share a toolbox: current software, a strong passcode, and care about what is installed.

What Lockdown Mode limits

As Apple describes it, Lockdown Mode limits some message attachment types, link previews, complex web technologies and some wired and wireless connections[S4]. The trade is deliberate: fewer features for a smaller attack surface. For most people the cost is noticeable; for someone with a credible reason to fear a targeted attack, it may be worth paying.

What the evidence says about Lockdown Mode

Apple’s spokesperson said in March 2026 that Apple is "not aware of any successful mercenary spyware attacks" against a device with Lockdown Mode enabled[S4]. That is a statement of non-awareness, not independent measurement.

Outside evidence is consistent with it, narrowly. Google’s analysts reported that the Coruna kit exits when Lockdown Mode or private browsing is on[S7], and that DarkSword is blocked by Lockdown Mode[S8]. Apple said in March that Lockdown Mode blocks the leaked DarkSword attacks[S9]. In 2023 Citizen Lab and Apple believed Lockdown Mode would have blocked the BLASTPASS chain[S11].

The gaps matter too. Calif’s analysis of a September 2026 CoreGraphics flaw, which Apple said may have been exploited in an extremely sophisticated attack, notes that Apple has not said whether Lockdown Mode blocks it[S10]. These are data points about specific chains. They are not a guarantee against the next one.

Our assessment: act, verify, and keep expectations honest

The Lab’s reading is practical. A real notification deserves action the same day: update, consider Lockdown Mode, contact an expert helpline, and keep the evidence. Verification comes before action only in the sense that the owner reaches Apple by typing the address, not by following a message.

Lockdown Mode is the strongest consumer measure Apple documents, and the evidence on it is encouraging but thin. The honest phrase is no known successful attack, which is Apple’s, not immune, which nobody has earned.

A short checklist after a notice

• Verify it by signing in to the Apple Account yourself, not through the message.
• Keep the notification, its date and any related emails, without forwarding them to unknown parties.
• Update the phone and consider Lockdown Mode, accepting the features it turns off.
• Contact an expert helpline that Apple names, rather than a number in the message.
• Do not reset or replace the phone until you have decided whether an examination is wanted, because a replaced phone cannot be examined. Write down, while it is fresh, when the notice arrived, how it was displayed and what the owner did next; those details are easy to lose and cheap to record.

What the Lab is watching

• Whether Apple publishes more detail on notification triggers or confirms how many users receive each wave.
• Whether Apple says if Lockdown Mode blocks the September CoreGraphics flaw.
• Further research follow-ups on notified people in other countries.
• Impersonation campaigns that copy Apple’s wording.

What this means for examiners

When a client arrives after a notification, ask for four things: the device, the notification itself (screenshot or original email, with its date), how it was verified, and any changes made to the phone since. Do not reset the phone. Explain in advance that the notice is a targeting signal, and that an examination may confirm something, find nothing, or be unable to decide.