Thailand has asked Apple for answers after the company sent spyware threat warnings to iPhone users in 99 countries, in the latest sign of how far a suspected mercenary spyware campaign has reached.

Thailand's Digital Economy and Society (DES) Ministry met Apple representatives after the alerts were issued, and the ministry said Apple had not confirmed any evidence linking the latest campaign to Pegasus, the spyware made by NSO Group. Apple is preparing a further public statement to clarify the situation for users in Thailand and to offer advice on protecting their devices.

The meeting took place on Wednesday 11 November 2026 and followed a discussion at Thailand's National Security Council, where Prime Minister Anutin Charnvirakul raised concerns about escalating cyber threats around the world.

What Apple told Thailand

DES Minister Chaichanok Chidchob said Apple explained that its Threat Notification system had detected indications of attempted cyber-attacks through technical metadata before warnings were sent to the accounts it believed were targeted. Under its privacy policy, Apple said it could not identify the owners of the affected devices or confirm whether any attempted attack had succeeded.

Apple has also not disclosed how many users in Thailand received the notifications. Anyone who receives one and suspects their iPhone may have been compromised can seek an examination through Thailand's National Cyber Security Agency or trusted external specialists, the ministry said.

The minister said the alerts referred to Pegasus to help users understand the nature and severity of the threat, because the spyware is internationally recognised for sophisticated surveillance. Pegasus is particularly associated with so-called zero-click attacks, in which a target device can be compromised without the user opening a file, clicking a link or taking any action. Apple has nevertheless stressed that it has no confirmed information establishing whether Pegasus, or another particular type of spyware, was involved in the latest incident.

German lawmakers among those warned

The warnings began reaching phones on 29 October 2026, according to a letter from Germany's Federal Office for Information Security (BSI) seen by the country's digital minister. Members of the Bundestag and the federal government were among those who received them, Digital Minister Karsten Wildberger confirmed.

The BSI wrote to recipients on 30 October telling them to assume, as a precaution, that their device may have been compromised. The agency said it did not know how many recipients' devices were actually infected and how many were only targeted.

Apple said the batch went to targeted users in 99 countries, and that it has now notified users in more than 150 countries in total since the programme began. The company sends the alerts when it believes a person has been individually targeted by mercenary spyware, usually because of who they are or what they do, and describes them as high-confidence warnings while noting its investigations can never achieve absolute certainty.

No attribution, and no proof of infection

Nobody has said who is behind the campaign. Apple does not attribute these attacks, and neither Apple nor the German authorities have said who may be behind it. The alerts also do not show whether an attack succeeded, and no compromised phone has been publicly confirmed.

Apple says genuine threat notifications never ask recipients to click links, open files, install apps or profiles, or hand over an Apple Account password or verification code. Users who receive a warning should update their iPhone to the latest version of iOS, turn on Lockdown Mode if they are at risk, and seek expert help before erasing anything, so any evidence on the device can be preserved.

The alerts arrived shortly before the final rounds of negotiations over industry standards for commercial hacking tools under the voluntary Pall Mall Process, with a meeting in Paris on 11 and 12 November. For now, the central questions remain unanswered: who ordered the attacks, how many devices were infected, and what, if anything, was taken.