The German government has said it is taking Apple spyware warnings 'very seriously' after it emerged that the threat notifications have been sent to users in 99 countries, including members of Germany's parliament and federal government.
German government spokesperson Stefan Kornelius said Berlin was "taking the incident and the warning very seriously," according to the Financial Times. He did not specify who in the federal government had been targeted, including whether Chancellor Friedrich Merz was among them.
Radwan Mortada, a Beirut-based filmmaker, said in a post on X that he received a new threat notification from Apple warning that there had been "another attack against your device" after an earlier spyware attack in 2021. Apple's latest batch of threat notifications went out to users in 99 countries, according to the notice Mortada received.
Apple periodically sends threat notifications when it believes a user has been individually targeted by "mercenary spyware," which it describes as "vastly more sophisticated than regular cybercriminal activity." This spyware often uses zero-click exploits that can hack users almost invisibly. Apple does not attribute attacks to specific governments or confirm whether a device has actually been compromised.
German digital minister Karsten Wildberger confirmed over the weekend that members of the Bundestag and the federal government had received the alerts, which began arriving on 29 October. Speaking on ARD's Bericht aus Berlin, Wildberger said there had been "a notification from Apple that certain devices may have been compromised with so-called spyware."
Wildberger said the BSI had "reacted super quickly" and advised those affected to assume their devices may be compromised because the alerts do not show whether an attack succeeded. According to the BSI, such spyware can give attackers access to messages, calls, contacts, calendar data and location, and can activate a phone's microphone and camera.
Neither Apple nor the German authorities have said who may be behind the attack. Governments rarely build these tools themselves. Many buy them from private vendors, the best known being Israel's NSO Group, which sells the controversial Pegasus spyware. Germany's own central federal law agency, the BKA, reportedly bought access to Pegasus in 2019.
Analysis
Why This Matters
- The 99-country scope suggests a coordinated, large-scale spyware campaign targeting politicians, journalists and activists globally.
- Politicians' compromised devices could expose sensitive communications, including encrypted messages, location data and private meetings.
- Apple's threat notifications are a rare public signal of mercenary spyware activity, but their ambiguity leaves victims uncertain about whether an attack succeeded.
Background
Mercenary spyware such as NSO Group's Pegasus has been used by governments to surveil journalists, human rights lawyers and opposition figures. These tools often exploit zero-day vulnerabilities and can be deployed without the target clicking a link. Apple began sending threat notifications in 2021 after being sued by NSO Group. Germany's BKA reportedly acquired Pegasus in 2019, though it is not known whether it has used it.
Key Perspectives
Apple: The company sends threat notifications when it detects likely targeted attacks, but does not attribute them to specific governments or confirm compromise.
German government (Stefan Kornelius): Berlin is "taking the incident and the warning very seriously."
BSI (Federal Office for Information Security): Advised recipients to treat their devices as potentially compromised and warned of the capabilities of such spyware.
What to Watch
- Whether Germany or other governments formally attribute the attacks to a specific state actor or vendor.
- If Apple releases further details on the timing or common characteristics of the 99-country campaign.
- Possible responses from parliament, such as device security reviews or restrictions on officials' phone use.
Checked
12 claims in this story checked against 2 sources: 12 supported.
Show each claim
- SupportedThe German government said it was taking the spyware warning very seriously.TechCrunch: “German government spokesperson Stefan Kornelius said the government in Berlin was “taking the incident and the warning very seriously,””
- SupportedApple’s latest batch of threat notifications went to users in 99 countries.TechCrunch: “Per the notice received by Mortada, Apple said its latest batch of threat notifications went out to users in 99 countries.”
- SupportedMembers of Germany’s parliament and federal government received Apple alerts saying their iPhones may have been targeted by spyware.Euronews: “Germany’s digital minister, Karsten Wildberger, has confirmed that members of the Bundestag and the federal government received warnings from Apple that their iPhones may have been targeted by spyware.”
- SupportedStefan Kornelius said Berlin was “taking the incident and the warning very seriously.”TechCrunch: “Per the Financial Times , German government spokesperson Stefan Kornelius said the government in Berlin was “taking the incident and the warning very seriously,””
- SupportedKornelius did not say who in the federal government had been targeted, including whether Chancellor Friedrich Merz was among them.TechCrunch: “but he did not say who in the federal government had been targeted, including whether German Chancellor Friedrich Merz was among them.”
- SupportedRadwan Mortada said Apple’s alert warned it had detected “another attack against your device.”TechCrunch: “Radwan Mortada, a Beirut-based filmmaker, said in a post on X that he received a new threat notification warning that Apple had detected “another attack against your device,””
- SupportedThe new alert followed an earlier spyware attack that targeted Mortada in 2021.TechCrunch: “after an earlier spyware attack targeted him in 2021.”
- SupportedThe alerts to affected German phones began arriving on 29 October.Euronews: “According to a letter from the Federal Office for Information Security (BSI) seen by Wildberger, the alerts began reaching the affected phones on 29 October.”
- SupportedWildberger said there had been “a notification from Apple that certain devices may have been compromised with so-called spyware”.Euronews: “Speaking on ARD’s Bericht aus Berlin on Sunday, Wildberger said there had been "a notification from Apple that certain devices may have been compromised with so-called spyware".”
- SupportedWildberger said the BSI had “reacted super quickly”.Euronews: “Wildberger said the BSI had "reacted super quickly" and written to everyone affected about what to do.”
- SupportedThe BSI advised those affected to assume their devices may have been compromised because the alerts do not show whether an attack succeeded.Euronews: “According to Wildberger, the BSI advised those affected to assume - as a precaution - that their device may have been compromised, because the alerts do not show whether an attack succeeded.”
- SupportedApple says it sends threat notifications when it believes a user has been individually targeted by mercenary spyware, which it describes as “vastly more sophisticated than regular cybercriminal activity”.Euronews: “Apple sends threat notifications when it believes that a user has been individually targeted by mercenary spyware, which it describes as "vastly more sophisticated than regular cybercriminal activity".”
