Loading story…
Apple is testing a new iMessage security alert in iOS 26.6 that warns users when a message may be malicious or pose a risk to device security or privacy. The feature, labeled “Malicious Message Detected,” appears in iOS 26.6 beta 5 and gives users the option to dismiss the warning or share the suspicious message with Apple to support investigation and improve future protections.
The warning appears aimed at threats such as phishing, spyware delivery, and potentially more sophisticated iMessage exploitation, although Apple has not disclosed how messages are classified or confirmed whether the feature will ship in the public release. The addition builds on existing Messages defenses including BlastDoor, Lockdown Mode, iMessage Contact Key Verification, and spam filtering, and follows years of scrutiny over advanced iMessage attacks, including past zero-click exploits that bypassed earlier safeguards.
See real exploitation activity before you spend the cycle.
1 event from the most recent confirmed update back to the earliest known activity.
Reports on iOS 26.6 beta 5 say Apple added a new 'Malicious Message Detected' warning for iMessage. The alert would warn users about potentially malicious messages and offer an option to share the suspicious message with Apple for investigation.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Apple sent a new round of threat notifications to users it believes were targeted by **mercenary spyware** capable of compromising `iPhone`, `iPad`, and `Mac` devices. The company said the latest alerts reached customers in **110 countries**, and that it has now notified users in **more than 150 countries** since launching the program. The updated warning process includes a **lock-screen push notification**, an email, and a notice on the user’s Apple account page, reflecting a broader effort to ensure suspected victims recognize the seriousness of the targeting. Apple’s guidance tells recipients to seek expert help and enable **Lockdown Mode**, a hardened security setting designed for people at elevated risk of targeted attacks. According to Apple, it has not observed a case in which a device was successfully compromised while Lockdown Mode was enabled. Researchers said the stronger notification flow can help victims identify spyware targeting earlier and may support wider investigations into abuse by governments and commercial surveillance vendors.
Aug 20, 2026
WhatsApp has begun a limited beta rollout of **Scam Alert**, an optional feature that uses on-device machine learning to flag likely scam messages from non-contacts while preserving end-to-end encryption. Users can decide whether to block, report, continue, or trust a flagged conversation, and can review Scam Alert activity in the app. WhatsApp said message content does not leave the device for classification, and the company has expanded its bug bounty program to cover the new feature, including its model weights and analytics pipeline. To reduce privacy risks and targeted manipulation, WhatsApp said it verifies model releases through a transparency process that publishes each version’s `SHA-256` hash to a third-party append-only ledger before deployment, while model downloads are routed through OHTTP relays with anonymous credentials. The company also said it measures effectiveness through a confidential federated analytics pipeline using Trusted Execution Environments, anonymous aggregation, and differential privacy, and may let users optionally share the last five messages from trusted chats to improve model accuracy. The rollout comes as Signal has also introduced automatic key verification based on key transparency logs and independent auditing to detect unauthorized public key changes in encrypted conversations.
Aug 19, 2026
Apple introduced **Impersonation Risk Detection** in iOS 27 and iPadOS 27, an opt-in privacy feature that helps participating apps identify actions potentially tied to active social-engineering or impersonation scams. The operating system assesses device-use, Apple Account, interaction, timing, contextual, and limited sensor-data signals locally, while excluding the contents of Photos, Messages, and Mail. Supported apps receive only an `unknown`, `medium`, or `high` risk assessment rather than the underlying data. Developers can use that result to display warnings, delay sensitive transactions, or require identity verification before actions such as account-security changes or large payments. Users can control global and per-app access in Privacy & Security settings, though setting changes may take up to 24 hours to take effect; effectiveness depends on both user opt-in and app adoption.
Sep 24, 2026