Apple has sent some users alarming notifications indicating that their iPhone could have been hacked.

“Apple detected a mercenary spyware attack targeted at your iPhone,” the message sent to users in 110 countries this week reads. “There are actions you can take now to help protect your data and device.”

The notifications are part of a relatively new set of security features that Apple has introduced aimed at detecting advanced and powerful cyber attacks on its users. And the nature of them means that anyone receiving them should take them incredibly seriously.

Apple introduced the threat notifications in 2021 and has sent them multiple times per year, to users in more than 150 countries. They are intended to “inform and assist users who may have been individually targeted by mercenary spyware attacks, likely because of who they are or what they do”, according to a support page on the company’s website.

As that suggests, the threat notifications are intended to alert users to particularly sophisticated hacks, where attackers use large amounts of resources to target specific individuals. As such, they tend to be used by attackers working on behalf of nation states, against specific individuals such as journalists, activists, politicians, and diplomats.

That means that most people are likely never to be targeted by such advanced spyware, or to receive the alert. But it also means that anyone receiving such a notification should treat it with particular urgency.

When Apple detects such an attempted attack, it shows the threat notification as well as sending them an email. Users receiving them are giving extra information on how to protect their accounts – which might include turning on Apple’s “Lockdown Mode”, which removes some of the iPhone’s features to further secure it against attackers, and getting emergency assistance.

“This warning is a reminder that even tightly controlled ‘walled garden’ ecosystems are not immune to spyware,” said Bogdan Botezatu, senior direct of threat research and reporting at Bitdefender. “Apple’s security model raises the cost of an attack, but well-funded adversaries can still use zero-day vulnerabilities, zero-click exploits and sophisticated infection chains to reach carefully selected targets.

“The fact that notifications reached users in 110 countries illustrates the global reach of the spyware industry despite the fact that these are not mass attacks. The vast majority of users are unlikely to encounter this type of attack.

“For recipients, however, the potential consequences are severe: advanced spyware may expose messages, calls, location data, credentials, files, and in some cases the device’s microphone or camera. Recipients should verify the warning directly through their Apple account, enable Lockdown Mode, install all available updates and seek specialist assistance.”