VULNpocalypse
HighEcosystem changeOngoing

Apple warns iPhone users in 99 countries of mercenary spyware targeting, including German lawmakers

Apple began sending new mercenary spyware threat notifications in 99 countries, including to German lawmakers; vendor and exploit are not confirmed.

Published
Updated
Exploitation
Yes, Apple says it detected targeted mercenary spyware attacks and notified users in 99 countries; whether any device was actually compromised is not confirmed.

What happened

Apple sent a new round of threat notifications about mercenary spyware to targeted users in 99 countries. Apple’s notice says it has now notified users in over 150 countries in total, and that it does not attribute the attacks to any specific attackers or geographical regions (CyberScoop). Researcher Costin Raiu said the round relates to new attacks and is separate from the August wave (GBHackers). Recipients include journalists and documentary filmmakers (CyberScoop).

Germany’s federal cybersecurity office, the BSI, said several members of the Bundestag and other public figures have received the Apple notification since October 29, 2026 (Security Affairs). Digital minister Karsten Wildberger confirmed that members of the Bundestag and the federal government were among those warned (Security Affairs). The government has not said who was targeted, including whether Chancellor Friedrich Merz was among them (TechCrunch). Der Spiegel reported that the notifications went to staffers, lawmakers and journalists in a delegation traveling with Merz in Asia. Green Party co-leader Franziska Brantner said she was among the recipients (The Record).

Outside Germany, Beirut-based filmmaker Radwan Mortada said he received a notification about “another attack against your device,” after an earlier spyware attack targeted him in 2021 (TechCrunch).

What is not confirmed:

  • The spyware vendor, the exploited vulnerability, the delivery mechanism and the responsible government are not identified in the quoted notice (GBHackers). No CVE for this wave is confirmed.
  • The BSI says it does not know whether the notifications indicate actual compromises or only attempted attacks (Security Affairs).
  • Apple’s August wave covered 110 countries. The two rounds are separate and the country counts should not be added together (GBHackers).

The timing matters for policy. The notifications arrive shortly before final negotiations on voluntary industry guidelines for commercial hacking tools under the Pall Mall Process (CyberScoop). A Citizen Lab researcher said a Pall Mall meeting is planned in Paris on November 11-12 (The Record).

Am I affected?

  • You received an Apple threat notification. Apple describes these as high-confidence warnings that you were targeted. A notification does not prove the device was compromised, and Apple acknowledges its investigations cannot be absolutely certain (GBHackers). The BSI advises recipients to assume the device may have been compromised (TechCrunch).
  • You did not receive one. That does not rule out an infection, according to Citizen Lab’s John Scott-Railton (CyberScoop). Apple says most users will never be targeted by this kind of spyware (Security Affairs).
  • How to verify a notification. Sign in to your Apple Account manually and look for the banner. Apple also delivers warnings by email and directly on supported iPhones (GBHackers). The BSI lists the lock screen, settings, email and the top of account.apple.com after sign-in (Security Affairs).
  • Treat as a scam. A genuine Apple warning never asks for passwords, verification codes, app installs, configuration profiles or file downloads (GBHackers).

What to do now

  1. Do not ignore the alert. Verify it by signing in to your Apple Account yourself, not through any link or message (GBHackers).
  2. Turn on Lockdown Mode and contact Access Now’s Digital Security Helpline, which is available around the clock (GBHackers, CyberScoop). Lockdown Mode makes new attacks harder but does not remove an existing infection. It limits message attachments, link previews and FaceTime calls from unknown people (Security Affairs).
  3. Update the operating system immediately, unless you plan a forensic analysis (Security Affairs).
  4. If the risk looks high, the BSI suggests replacing the device, resetting every account used on it and changing the phone number. Then set a new passcode, change your Apple account and email passwords and make sure two-factor authentication is on (Security Affairs). Reporting differs on tone: The Record says the BSI letter told recipients to assume infection and replace devices immediately (The Record).
  5. Turn on Signal’s registration lock and WhatsApp’s two-step verification, each with a new PIN, and remove linked devices you do not recognize (Security Affairs).
  6. Be cautious about companies offering paid fixes for spyware infections, as Scott-Railton warned (CyberScoop).
  7. In Germany, recipients can email the BSI Service Center, which helps the agency estimate how many people are affected (Security Affairs).

Sources