Germany’s cybersecurity agency has warned that several members of parliament and other public figures received Apple alerts about targeted mercenary spyware attacks, urging recipients to treat their devices as potentially compromised.
The Federal Office for Information Security (BSI) says the notifications began arriving on October 29, 2026. In a letter dated October 30, it informed Bundestag members of the threat and recommended protective measures, asking affected individuals to contact the agency directly.
In its November advisory, the BSI says it cannot determine whether the alerts reflect successful infections or attempted attacks. It has not identified the recipients, the spyware involved, or those responsible.
The BSI is Germany’s federal cybersecurity authority, while the Bundestag is the country’s federal parliament.
Warnings extend beyond Germany
Security researcher Costin Raiu flagged the latest round of Apple threat notifications on October 30, describing it as separate from the August wave and tied to new attacks.
According to the Apple notice he shared, the latest notifications were sent to targeted users in 99 countries.
Apple describes its notifications as high-confidence warnings that someone has been individually targeted. Its guidance says the company has notified users in more than 150 countries since 2021, but does not attribute attacks or notifications to particular operators or regions.
The BSI warns that mercenary spyware can infect devices through zero-click attacks, such as specially crafted messages that require no interaction. However, it has not disclosed the infection method used in the attacks behind these notifications.
A successful compromise can expose messages, including those in encrypted messaging services, along with calls, contacts, calendars, and location information. Attackers may also access the camera and microphone, creating significant privacy risks for targets and their contacts.
BSI recommends lasting protection
Unless a forensic examination is planned, recipients should update their operating system immediately, the BSI advises. It also recommends considering Lockdown Mode, available under Settings > Privacy & Security, and keeping it enabled permanently, including on a replacement device.
Lockdown Mode restricts features such as message attachments, link previews, and FaceTime calls from unknown contacts. It makes future attacks harder but does not remove an existing infection, the agency cautions.
People who assess their compromise risk as high should consider replacing their device, resetting accounts used on it, and changing their phone number. Further measures include setting new passcodes and passwords, enabling two-factor authentication, setting up a new authenticator, and reviewing linked devices in Apple, Signal, and WhatsApp accounts.
Recipients can verify an alert by manually visiting account.apple.com. Genuine warnings never ask users to open files, install apps or profiles, or disclose passwords or verification codes.
Leave a Reply