Germany Warns Lawmakers After Mercenary Spyware Threats Hit iPhones

A fresh wave of commercial spyware — described by Apple as "mercenary" — has targeted members of the Bundestag, federal government officials, and public figures in Germany. The threat notifications began arriving on affected iPhones on October 29, but the case only emerged into public view last week after the government confirmed the incidents and the Federal Office for Information Security (BSI) distributed advisory letters.

What happened

The story broke when the public broadcaster ARD reported on Sunday, November 2, that numerous devices belonging to parliamentarians and civil servants had received Apple alerts indicating possible spyware infection. Digital Minister Karsten Wildberger (CDU) confirmed the details on the talk show "Bericht aus Berlin."

According to a BSI letter seen by ARD and tagesschau.de, Apple's threat notifications started arriving on October 29. The document informed recipients that Apple had detected an attack using "mercenary spyware" — the term Apple uses for commercial surveillance tools sold to governments, most notably the Pegasus spyware developed by Israel's NSO Group.

"At this point we have no further information on the specific cause or background of these notifications," the BSI wrote in the letter. The agency advised recipients to "assume as a precautionary measure that the device may have been compromised." Wildberger praised the agency's rapid response, saying the BSI "reacted super well" and had written to everyone affected. He declined to speculate on who might be behind the attack or how many lawmakers were targeted.

Federal government spokesperson Stefan Kornelius told the Financial Times that Berlin was "taking the incident and the warning very seriously," but did not specify who in the government was affected — nor whether Chancellor Friedrich Merz was among those targeted.

What are Apple's threat notifications?

Apple threat notifications are high-confidence alerts sent when the company believes a user has been individually targeted by mercenary spyware. Unlike mass phishing campaigns, these attacks are directed at specific individuals — typically journalists, activists, diplomats, and, in this case, political figures.

Apple describes mercenary spyware as "vastly more sophisticated than regular cybercriminal activity." Once successfully installed, it can grant deep access to a device: call logs, messages, contact lists, location data, media files, and remote activation of the microphone and camera. The exploits are often "zero-click" — meaning they do not require the victim to click any link or open any file for the infection to occur.

The notifications appear on the iPhone lock screen, in the Settings menu, and are also sent by email. Apple stresses that the alert does not necessarily indicate a successful compromise — only that it detected sophisticated attempts at intrusion.

"We do not attribute the attacks to any specific governments or say whether someone's phone has actually been compromised," the company states. For that reason, the BSI advises assuming the device is compromised.

A global attack, not just German

What stands out is that Germans are not alone. According to threat researcher Costin Raiu, who flagged the new wave on X (formerly Twitter) on October 30, the notifications were sent to users in 99 countries. Apple confirmed it had sent high-confidence threat notifications to selected users across 110 countries.

At least two users outside Germany have already spoken publicly. Ragıp Soylu, Middle East Eye's Turkey bureau chief, posted on X that this was his third threat notification that year. "State actors using mercenary spyware have repeatedly tried to hack my phone," he wrote. He called the notification a "badge of honour" and said he regarded the hack attempts as "an endorsement for the reporting I do."

Radwan Mortada, a Lebanese investigative journalist and documentary filmmaker based in Beirut, also shared his notification on X, alerting that Apple had detected "another attack against your device" — following earlier attacks in 2017 and 2021. Mortada is known for his investigations into Middle East security issues.

The context of mercenary spyware in Europe

Germany is not an isolated case. In recent years, several European countries have faced similar attacks linked to commercial surveillance software. The European Parliament has held hearings on the abusive use of Pegasus, and the European Commission has proposed new regulations to restrict the sale and use of such tools.

Ironically, Germany's own federal criminal police agency, the BKA, purchased access to Pegasus in 2019 — illustrating the typical paradox in which states that combat spyware against criminals also deploy it against suspects.

The mercenary attacks come at a particularly sensitive time for European democracy. The Council of Europe actively monitors the use of spyware against elected officials and journalists. Discussions about the "Pall Mall Process" — a set of EU guidelines for the use of commercial hacking tools — are in advanced stages of negotiation, reinforcing the urgency of regulation on the topic.

How to protect yourself

Apple recommends that users who receive these notifications:

- Enable Lockdown Mode in iPhone settings; - Keep iOS updated to the latest version; - Use a passcode and two-factor authentication; - Enable Stolen Device Protection; - Seek assistance from digital security experts.

Digital rights groups like Access Now recommend that affected users also contact organizations such as Citizen Lab, which can help investigate whether the device was actually compromised.

As mercenary spyware grows more sophisticated and accessible, how can we protect entire democracies from attacks aimed at their most important elected representatives?

Sources: TechCrunch, Euronews, TechSpot

✓ Independent sources cross-checked and verified before publishing