An unprecedented number of Apple customers have reported receiving a recent threat notification alerting them to suspected spyware attacks targeting their devices, according to experts who investigate these types of incidents. 

Several people publicly and privately reported receiving Apple’s spyware alerts over the weekend, after Apple sent out a new wave of notifications on Friday alerting customers in 110 countries that they had been targeted with powerful spyware. 

From time to time, the technology giant sends these types of alerts in batches to customers that it believes have been either targeted or compromised with malware normally used by governments, which the company refers to as “mercenary spyware.” In the last few years, Apple says it has alerted people in more than 150 countries.

The latest batch appears to have been the largest yet, per one of the digital rights groups that Apple suggests victims of spyware reach out for help.  

Mohammed Al-Maskati, the director of the Access Now team of investigators who review and investigate reports to the helpline, told TechCrunch that since Friday, they have received a record high number of people reaching out for help. This includes people who had already received threat notifications in the past. 

Al-Maskati said the number is around 30% to 40% more than the nonprofit’s investigators usually receive after Apple sends out new notifications. 

An unusually large number of people have also publicly reported receiving these notifications over the weekend as well, according to several social media posts.

One of them is a Ukraine Armed Forces soldier who said he is fighting the war against Russia. The soldier, who asked to remain anonymous to protect himself, said that he initially thought it was a scam, until he verified it with Apple.

“I was a bit surprised to be honest, I wouldn’t have thought I was important enough for them to target me like this. I am flattered though,” the soldier told TechCrunch. 

The soldier also said that he is aware of other people in Ukraine’s military who have received the same notification. “They were a bit worried,” he said. 

The Computer Emergency Response Team of Ukraine (CERT-UA) did not respond to TechCrunch’s request for comment, asking whether it was aware of other Ukrainians, particularly soldiers, receiving these notifications.  

John Scott-Railton, a senior researcher at The Citizen Lab, a digital rights group that has investigated government spyware attacks for more than 15 years, told TechCrunch that the reports show that spyware attacks may be more prevalent than people realize. 

“The scale and geographic diversity of public posts about receiving notifications are pretty unprecedented,” said Scott-Railton. “For every public notification like this, you can imagine there’s a huge notification iceberg that the public will never learn about. This is a clear indication that something bigger is going on.”

Both Al-Maskati and Scott-Railton said that the volume of people receiving the alerts could also be attributed to Apple’s new methods of alerting users.

Starting this year, Apple now notifies users on their iPhone lock screen, in their Settings app, via the email associated with their Apple account, and when users log in to their Apple Account on the web.

“Apple’s new notification method has helped raise awareness of the issue’s importance, making it harder for users to ignore,” Al-Maskati said.

Apple did not respond to TechCrunch’s request for comment. 

If you’ve received one of these notifications, take it seriously. If you are not a journalist, dissident, or human rights defender, there are other organizations that can help you investigate.

If you haven’t already, as Apple and experts suggest, turn on Lockdown Mode, a special security feature designed to make it harder to hack iPhones, iPads, and Mac computers. Apple has said that it is not aware of anyone who had Lockdown Mode enabled getting hacked.

Samsung appears to be exploring a new full-size wireless headphone product, potentially expanding its Galaxy audio lineup beyond earbuds. Code and connection icons found in the Galaxy Wearable app reference a device reportedly known internally as Galaxy H1.

SamMobile first reported the discovery on Aug. 14. Samsung has not announced Galaxy H1, but a full-size headset could fill a longstanding gap in its Galaxy device ecosystem; its final name, design, specifications, price, and release date remain unknown.

The app leak suggests a headphone project

The evidence comes from Galaxy Wearable app code and icons that reference “Galaxy H1” and depict headphones with a headband and ear cups. The assets suggest a wireless, full-size design rather than another pair of Galaxy Buds.

Software references can appear before Samsung formally announces hardware. In July, the unannounced Galaxy S26 FE and Galaxy Tab S12 appeared in a Google app, providing another recent example of software surfacing possible products ahead of launch.

The H1 icons are not necessarily renders of finished hardware. The Verge reported that they indicate the general wireless headphone form factor but may not show the final design. “Galaxy H1” also appears to be an internal name rather than a confirmed retail brand.

If H1 reaches the market as a premium product, it could add a Galaxy-branded option alongside high-end headphones from Apple, Sony, and other established audio brands. Samsung has not disclosed its intended price segment or competitors.

Samsung has sold full-size wireless headphones before. Its Level range included the Level On Wireless Pro, announced in August 2015 with Bluetooth connectivity and active noise cancellation.

Samsung later completed its Harman International acquisition in March 2017, adding brands including AKG, JBL, and Harman Kardon to its audio portfolio. More recently, Samsung has continued expanding its wearable ecosystem with devices including the Galaxy Watch9 and Watch Ultra2.

A 2027 launch is possible, but specs remain unknown

SamMobile says the headphones could arrive sometime in 2027, but Samsung has announced no release date. Any narrower launch window or connection to a specific Galaxy event remains speculative.

Core features are also unknown. Active noise cancellation, device switching, Samsung audio codecs, and AI-assistant support would be plausible based on existing Galaxy products, but none has been confirmed for H1. Battery life, charging, Bluetooth version, microphones, and wired-audio support have not been disclosed.

Samsung’s current Galaxy Buds4 series supports Bluetooth 6.1, Auto Switch, and Samsung Seamless Codec UHQ. A future Samsung headset could inherit some of those ecosystem features, but the current leak provides no evidence that H1 will.

If the product reaches commercial release, compatibility, software support, and Samsung-specific features could determine how well it fits managed Galaxy deployments. Samsung’s reported Galaxy Watch9 support expansion shows how update commitments can affect device-lifecycle planning. Until Samsung confirms H1 and provides product and support details, IT teams have too little information to factor it into refresh or purchasing plans.

Read more: Samsung’s premium hardware lineup is expanding elsewhere as well, with the Galaxy Z Fold8 and Fold8 Ultra adding new choices for organizations and buyers evaluating the latest Galaxy devices.

A routine-looking download can turn into a much bigger problem for Mac users.

Jamf Threat Labs found an AmnesiaStealer campaign reaching macOS through a fake software download and capable of keeping attackers connected to browser sessions after infection. Researchers say the added access can extend the intrusion beyond the malware’s initial data theft.

An attack begins with a user-run Terminal command, but its more unusual stage comes later, after AmnesiaStealer is already inside the system.

A fake download opens the door on macOS

Jamf Threat Labs traced the campaign to a counterfeit GitHub-style page offering a macOS download. Visitors are instructed to copy an encoded command into Terminal, using a ClickFix attack chain that relies on the target to execute the malicious instructions.

Running the command triggers a shell script that downloads and launches AmnesiaStealer. The malware also attempts to obtain the user’s login password as it prepares to collect information from the system.

Turning stolen data into browser access

AmnesiaStealer first collects information stored on the infected device. Jamf found it targeting browser data and the macOS Keychain, with Apple Notes and Telegram also in its sights.

Mac infostealers have pursued similar information before. FrigidStealer, for example, has targeted browser credentials and Apple Notes.

The malware can then download an optional component called stream_module. This can copy a Chromium browser profile and launch another browser instance outside the user’s view. Operators can see what appears in the browser and send keyboard or mouse input back to it.

Copied browser data can preserve an authenticated session. Services that still recognize an existing session may not immediately ask for another login. Stolen session cookies can create a similar problem, while remote browser control also allows an operator to interact with the session from the compromised system.

Must-read Apple coverage

Work accounts raise the cost of a compromised device

If you use a Mac for work, treat a suspected AmnesiaStealer infection as more than a malware-removal job. Accounts already open in the browser may include company email or cloud services, depending on your role and access.

Take the affected device offline and contact your IT or security team if it is company-managed. Use a clean device to revoke active sessions and reset passwords for sensitive accounts. Review recent activity for anything you do not recognize.

If your role includes privileged or financial access, tell responders which services were open or recently used. A session tied to an administrative console or finance platform can carry permissions well beyond an ordinary user account.

Credential recovery should run alongside endpoint investigation. Unexpected Chromium processes or copied browser profiles can help establish whether the browser-control component was used. Recent threats such as ClickLock malware have already made credential theft a concern for Apple users, and AmnesiaStealer adds another form of access for defenders to account for after an infection.

Other News: WhatsApp is testing on-device AI scam alerts that flag suspicious messages from unknown senders without sending message content to the cloud.