Apple Spyware Alerts Reach 99 Countries as German Lawmakers’ iPhones Flagged

Apple has issued a new round of threat notifications warning users across 99 countries that they may have been targeted by mercenary spyware, and the list of recipients includes members of Germany’s Bundestag. The alerts, which began landing on 29 October, prompted Germany’s Federal Office for Information Security (BSI) to advise affected lawmakers and public figures to treat their iPhones as potentially compromised.

• Global scope: Apple’s latest notification batch reached targeted users in 99 countries, according to a screenshot shared by threat researcher Costin Raiu.
• German response: The BSI wrote to Bundestag members on 30 October and asked anyone affected to contact the agency directly.
• No attribution: Apple does not name the attackers or regions, and Raiu said logs so far show no signs confirming which actor is responsible.

What Apple’s alert actually says

According to the notification, Apple detected an attack involving “mercenary spyware” — commercially built surveillance tools that state actors have often deployed against specific individuals. The company has sent these warnings several times a year since 2021, and its support page states they have reached users in more than 150 countries in total.

Apple does not attribute the attacks or the notices to specific malicious actors or geographical regions. The company has said the “extreme cost, sophistication, and worldwide nature of mercenary spyware attacks” make them some of the most advanced digital threats in existence today. The alerts are high-confidence warnings, but they do not confirm whether an intrusion actually succeeded.

Raiu flagged the new wave on X on 30 October, noting it was separate from Apple’s August notifications and tied to new attacks. He told The Record that he had reviewed several victims’ notifications and had not yet seen evidence in the logs identifying the culprit.

Germany’s response and the Bundestag warnings

The BSI confirmed that members of the Bundestag and other unnamed notable individuals had received Apple’s warnings. In its note, the agency said recipients “should therefore assume that their device may have been compromised.” It acknowledged it does not know whether attackers broke into the phones or merely attempted to.

Government spokesperson Stefan Kornelius said Berlin was “taking the incident and the warning very seriously” and working to investigate the circumstances, but he did not specify which federal government members were targeted — including whether Chancellor Friedrich Merz was among them. Digital Minister Karsten Wildberger, speaking on ARD, confirmed that Bundestag members’ phones and the federal government may have been targeted, and said the BSI had contacted every affected individual in writing.

“Those affected who have received a corresponding warning message from Apple should therefore assume that their device may have been compromised.” — Germany’s BSI

This is not the first time spyware has touched Germany’s institutions. The federal police office, the BKA, reportedly bought access to a version of Pegasus, the controversial tool sold by Israel’s NSO Group, in 2019, and the government informed the Bundestag’s interior committee of the purchase in 2021.

Journalists come forward as the pattern repeats

Outside Germany, at least two journalists have publicly shared their alerts. Ragıp Soylu, Turkey bureau chief for Middle East Eye, called his notification a “badge of honour” and said it was the third he had received this year. “Likely state actors using mercenary spyware have repeatedly tried to hack my phone,” he wrote on X.

Radwan Mortada, a Lebanese investigative journalist and documentary filmmaker, said he received his warning on 29 October. He told The Record that Pegasus had targeted him in 2017 and 2021, and that the latest alert arrived days after the release of his Al Jazeera 360 film about the September 2024 pager explosions in Lebanon. Mortada said he has no concrete evidence linking the incidents, but that “the sequence of events, and their timing in relation to my investigative work, raise serious questions that cannot simply be dismissed.” He added that surveillance of journalists threatens the confidentiality of their sources.

John Scott-Railton, a researcher at Citizen Lab, told The Record that Apple made its threat notifications more visible in August to drive users to act. “Apple Threat Notifications make accountability happen,” he said.

What recipients are advised to do

The BSI recommends updating the phone’s software immediately unless a forensic analysis is planned, and switching on Apple’s Lockdown Mode and keeping it enabled — even on a new device — because it makes fresh attacks harder, though it does not remove an existing infection. For those judged to be at high risk, the agency suggests considering a new phone, resetting every account used on it, changing phone numbers, setting a new passcode and passwords, and enabling two-factor authentication, along with fresh PINs for Signal and WhatsApp.

Once inside a device, this class of spyware can read messages — including those in encrypted apps — and activate the camera and microphone, the BSI noted. In known cases it has arrived through zero-click exploits that require no action from the victim; knowledge of a target’s phone number was reportedly all attackers needed.

The episode underscores a structural problem rather than a technical one. Mercenary spyware is marketed as a tool for pursuing criminals and terrorists, yet it repeatedly surfaces on the phones of politicians, journalists and dissidents. Apple’s warnings are valuable, but they arrive after targeting has already occurred. What remains missing is not defensive technology — Lockdown Mode and similar hardening features exist — but political will to regulate a market that several European governments buy from even as their own officials appear on the target list. As long as that market stays profitable and opaque, another batch of notifications is only a matter of time.