If you have already changed your Apple Account password multiple times and are still seeing these notifications, the problem is likely not an actual attacker guessing your password. Instead, it is likely caused by a persistent system bug, an old device/service repeatedly sending expired tokens, or a "MFA Fatigue" phishing script trying to trick you.
Try this
Sometimes, an old or hidden background service retains an active token and gets stuck in an infinite verification loop.
- Sign out of all devices: Go to the Apple Account Management Page on a web browser. Review your trusted devices and manually remove any you do not completely recognize.
- The "Sign Out Everywhere" trick: Change your password one more time via the web browser. When prompted, explicitly select the option to "Sign Out Other Devices" or "Sign Out Everywhere." This invalidates all active session tokens universally.