Apple Warned German MPs and Ministers Their iPhones Were Targeted by Mercenary Spyware

Someone went after the iPhones of German lawmakers and members of the federal government with commercial spyware, and Apple saw enough of it to warn them. Nobody will say who was hit, and nobody knows who did it.

Since 29 October, several members of the Bundestag and other public figures have received Apple threat notifications saying the company detected an attack using so-called mercenary spyware. Germany's federal cybersecurity office, the BSI, describes that as commercially developed advanced spyware frequently used by state actors against specific people. The BSI says it does not know whether the alerts mean actual compromises or only attempted attacks.

The government confirms it

On Sunday, digital minister Karsten Wildberger went on ARD's Bericht aus Berlin and confirmed that members of both the Bundestag and the federal government were warned. There had been "a notification from Apple that certain devices may have been compromised," he said. He would not say how many people or who, only that the BSI reacted very quickly and wrote to everyone affected.

Government spokesperson Stefan Kornelius told the Financial Times officials take the matter very seriously. He declined to say which government members got alerts or whether Chancellor Friedrich Merz was among them. Apple has not commented.

Assume the phone is compromised

The BSI's letter, dated 30 October, told MPs to assume as a precaution that their device may be compromised and to get in touch. The stakes are high. Once spyware of this class is on a phone, the BSI says attackers can read messages, including those in encrypted apps, access calls, contacts, calendars and location, and switch on the camera and microphone.

Getting in does not require a mistake from the target. These tools can arrive through zero-click attacks that need no tap at all, the same trick researchers recently found being used to hit Al Jazeera through targeted online ads.

The advice that follows is blunt. Update iOS straight away unless a forensic analysis is planned. Lockdown Mode makes new attacks harder but will not remove an infection already there. For people at high risk, the BSI goes as far as replacing the device, resetting accounts and even changing the phone number, along with fresh PINs for Signal's registration lock and WhatsApp's two-step verification and a sweep for unknown linked devices.

Ninety-nine countries

Germany is not the only target. The notification itself says alerts went to targeted users in 99 countries, according to a screenshot posted by researcher Costin Raiu, who verified several of them. Apple does not attribute attacks to any actor or region, and Raiu said that so far there are no signs of compromise in the logs that could confirm who is responsible.

Some recipients have gone public. Ragip Soylu, Turkey bureau chief of Middle East Eye, got his third Apple notification this year. Lebanese filmmaker and journalist Radwan Mortada, previously targeted with Pegasus in 2017 and 2021, was warned too, The Record reported.

Apple made the notifications more visible in August. Citizen Lab's John Scott-Railton put their value simply: "Apple Threat Notifications make accountability happen." For now, the accountability stops at the warning. No one has publicly named the attackers or the government behind them.

Some offers on this page may be paid placements or contain affiliate links.