Credit: Yuliya Taba / iStock via Getty Images

Threat actors are always finding ways to make their attacks seem more believable—often by using urgent security matters that push victims to act quickly—so you should always be skeptical of messages and notifications warning you that your device or account has been compromised. That said, if you receive a spyware warning from Apple via push notification, it's likely real, and you shouldn't ignore it.

Apple's threat notification system is designed to alert individuals who have been targeted by mercenary spyware, such as Pegasus, which can silently infect devices and track everything a user does. Since 2021, the company has sent these alerts multiple times a year. In the vast majority of cases, those affected are in high-profile positions—such as politicians, journalists, and activists—that are at a high risk of being targeted. That means the average user is unlikely to ever receive one of these notifications, so it's important to understand how they work and be able to identify what's legitimate and what's not.

According to Apple's support document, threat notifications are now being distributed via push notifications to affected users' iPhones. These alerts will appear on the Lock Screen and in Settings. Users will also receive an email alert to the address linked to their Apple Account sent from [[email protected]]. (Previously, Apple sent alerts via email and Messages.) Lock Screen alerts will have a red warning icon and read "Apple Threat Notification: Apple detected a mercenary spyware attack targeted at your iPhone. There are actions you can take now to help protect your data and your device."

If you receive a push notification or an email that appears to be from Apple, you should take it seriously and also verify it in your device Settings and Apple Account dashboard, as scammers may try to capitalize on this by sending fake alerts that impersonate Apple. When you go to Settings on your iPhone, you'll see an Apple Threat Notification menu just below your main profile. Then, log into account.apple.com—there will be a banner at the top of the page labeled "Threat Notification" with a link to view additional details.

Legitimate threat notifications from Apple will never require you to click links, download files, install apps, or provide credentials by email or phone. If you're urged to do any of these things, it's a scam. You should be especially wary of security-related notifications if you're not a high-risk iPhone user who is likely to be targeted.

That said, affected users are advised to follow Apple's recommended steps to protect themselves. This may include turning on Lockdown Mode, an OS-level security setting that severely limits iPhone features in order to block malicious actors from gaining access. If you receive an Apple threat notification, you can also contact Access Now's Digital Security Helpline, which is available 24/7, for assistance.