A suspicious iMessage may soon come with a warning before it causes trouble.
Code discovered in iOS 26.6 beta 5 suggests Apple is testing a “Malicious Message Detected” alert that would warn users when Apple believes an iMessage may threaten their device or privacy. Users could also share the message with Apple to help investigate potential attacks.
For organizations using iPhones at work, the alert could help employees spot malicious messages sooner and strengthen mobile security awareness.
How the new iMessage warning works
According to MacRumors, the code found in iOS 26.6 beta 5 confirmed Apple was testing the alert, although users had not yet seen the notification appear on an iPhone.
The warning tells users that Apple detected a message from a sender who may be trying to harm the device or compromise their privacy. It includes three options: “Not Now,” “Share With Apple,” and “Don’t Report.”
Choosing “Share With Apple” would send the suspicious message to the company for further investigation. BGR quoted the alert as saying, “The most important step you can take to protect yourself and others from similar attacks is to share the message with Apple.”
Apple has not explained which messages will trigger the warning. MacRumors suggested the feature could respond to sophisticated exploits, phishing attempts, or other suspicious activity inside the Messages app.
Apple adds another layer of iMessage security
Apple has spent years strengthening iMessage against targeted attacks. The company introduced the BlastDoor sandbox with iOS 14 to isolate message content from the rest of the operating system.
Attackers have still found ways around those protections. A zero-click iMessage exploit disclosed in 2021 bypassed BlastDoor and installed spyware on targeted devices without requiring victims to open any links or attachments.
Apple later introduced Lockdown Mode, iMessage Contact Key Verification, and spam filtering. The new warning would add a more visible layer by telling users when Apple believes a specific message could pose a threat.
The feature could be particularly valuable for journalists, activists, politicians, and others at elevated risk of targeted spyware attacks.
The warning could create confusion
MacRumors noted that the alert resembles fake scam pop-ups commonly seen in Safari. A similar design may cause some users to question whether the warning actually came from Apple.
The resemblance could create a practical challenge for IT teams.
Companies may need to show employees what the official alert looks like, explain when to report a message, and warn them against entering credentials or sensitive information into prompts that imitate Apple.
A built-in alert will not replace mobile security training, device management, or timely software updates. Employees will still need guidance on suspicious links, unexpected attachments, and unusual requests for passwords or company data.
Must-read security coverage
- UK Police Convicts Pair in £5.5 Billion Bitcoin Launder Case
- Blackpoint Cyber vs. Arctic Wolf: Which MDR Solution is Right for You?
- How GitHub Is Securing the Software Supply Chain
- 8 Best Enterprise Password Managers
iOS 26.6 nears public release
Apple has released five iOS 26.6 betas and is expected to roll out the public update around the end of July. The company has not confirmed the final release date or whether the malicious-message warning will ship in the public version.
Security teams should monitor the final release notes and update employee guidance if Apple includes the feature. Clear reporting instructions could help workers respond correctly instead of dismissing a legitimate warning or trusting a convincing fake.
Read next: Apple reportedly cut some base iPhone 17 production as rising memory costs raised questions about pricing and upgrade timing.