Apple Issues Global Mercenary Spyware Alerts Across 110 Countries Amid Surge in Zero-Click Exploits

Executive Summary

On August 27, 2026, Apple concluded its most extensive threat notification campaign to date, alerting users across 110 countries that their devices may have been targeted by mercenary spyware. This wave of alerts follows a significant uptick in the deployment of sophisticated mobile surveillance tools designed to infiltrate iOS devices without user interaction. The notifications, which now appear directly on the iPhone Lock Screen and within the Settings menu, represent a shift in Apple's strategy to ensure high-risk warnings are not overlooked by targeted individuals, including journalists, diplomats, and activists.

Threat Analysis

The current threat landscape is dominated by the 'spyware-as-a-service' model, where private firms develop and sell high-end exploits to government clients. Unlike traditional cybercrime, these mercenary attacks are exceptionally well-funded and focus on a very small number of specific individuals. The recent surge in activity is characterized by the use of zero-click exploit chains, which require no action from the victim to compromise the device. These attacks often leverage vulnerabilities in iMessage, HomeKit, or third-party media processing libraries to gain initial access, followed by privilege escalation to achieve full kernel control.

Technical Details

Intelligence suggests that the recent wave of attacks may be utilizing the 'Coruna' exploit kit, which was recently identified targeting the hardware-level security features of Apple’s A17 and M3 silicon. The Coruna framework is designed for extreme efficiency, reusing kernel objects created during the initial exploitation phase to maintain persistence while minimizing the footprint left in system logs. Once the stager is injected, the final spyware implant—often a variant of Predator or a similar modular tool—can exfiltrate encrypted messages, record ambient audio, and track real-time GPS coordinates. Apple’s new on-device alerts are triggered by internal telemetry that identifies these specific 'exploitation artifacts' and unauthorized kernel memory modifications.

Attribution Assessment

While Apple does not publicly attribute these attacks to specific entities, the geographic distribution and the sophistication of the exploits strongly suggest nation-state involvement. The patterns of activity align with known mercenary groups such as the NSO Group and Intellexa, though new players in the exploit brokerage market, such as the recently sanctioned 'Operation Zero,' are increasingly providing the underlying zero-day vulnerabilities. The targeting of users in 110 countries indicates a broad, multi-client offensive operation rather than a single localized campaign.

Implications

The democratization of nation-state level offensive tools through the mercenary market poses a critical risk to global civil society. As exploit kits like Coruna become more modular and accessible to a wider range of state actors, the cost of high-level surveillance continues to drop. This trend forces technology providers into a constant cycle of emergency patching and necessitates the development of extreme security measures like Lockdown Mode, which significantly reduces the device's attack surface at the cost of functionality.

Recommendations

Encrygma recommends that all high-risk individuals immediately update to iOS 18.7.6 or higher to mitigate known vulnerabilities in the Coruna exploit chain. Users who receive a 'Mercenary Spyware' notification should immediately enable Lockdown Mode, which disables several complex web technologies and message attachment types that are frequently exploited. Furthermore, organizations should implement mobile device management (MDM) solutions that can detect signs of compromise, such as unexpected reboots or the presence of unauthorized configuration profiles.