Apple warns German politicians their iPhones may be infected with spyware

German cybersecurity authorities are urging politicians and other public figures to assume their iPhones may have been compromised after Apple issued warnings about highly sophisticated spyware attacks.

Members of parliament and other prominent individuals should take immediate precautions after Apple notified them that their iPhones may have been targeted by mercenary spyware, Germany's federal cybersecurity agency is warning.

The Federal Office for Information Security (BSI) said several members of the Bundestag and other public figures began receiving Apple's threat notifications on Oct. 29.

The agency has not established whether the attacks succeeded or merely tried to compromise the devices. Nevertheless, it’s advising recipients to assume their phones may have been infected.

Key points

• Apple has warned German lawmakers and other public figures about suspected mercenary spyware attacks
• Germany's BSI says it’s not clear whether the targeted devices were actually compromised
• The agency is urging recipients to take precautions, including securing their accounts and considering replacement devices
• The warnings follow the recent emergence of evidence of Pegasus spyware infecting the iPhone of a Serbian university rector
• Apple has also issued security updates addressing a vulnerability previously exploited in sophisticated attacks against specific individuals

German politicians among those targeted

Germany's digital minister, Karsten Wildberger, confirmed that members of the Bundestag and federal government received warnings from Apple indicating that their devices may have been compromised.

Wildberger told German broadcaster ARD that the BSI had responded quickly and contacted affected individuals with guidance on what to do next.

Officials have not said how many people received the warnings, who they are, or whether any devices were successfully infected.

The BSI sent a letter to members of the Bundestag on Oct. 30, alerting them to the threat and urging anyone who received a notification to contact the agency.

According to Security Affairs, the latest notifications appear to be part of an international wave of spyware warnings.

Lebanese filmmaker Radwan Mortada, who was targeted by spyware previously, also reported receiving an Apple notification. His warning indicated that Apple had alerted users in 99 countries.

The identity of the attackers remains unknown.

What is mercenary spyware?

Mercenary spyware refers to sophisticated commercial surveillance software developed by private companies and frequently used by government customers to monitor specific individuals.

Unlike ordinary malware, these tools are designed for highly targeted operations, often involving journalists, activists, politicians, diplomats and others whose communications may be of interest to intelligence services.

Some spyware can exploit previously unknown security vulnerabilities to infect a phone without requiring the owner to click a malicious link or open an attachment.

These so-called zero-click attacks are particularly dangerous because conventional advice about avoiding suspicious messages offers little protection against them.

Once a device is compromised, spyware may be able to access messages, including those exchanged through encrypted apps, as well as photographs, contacts, location information and other sensitive data. Some spyware tools can also activate the microphone and camera without the owner's knowledge.

Apple stresses that the overwhelming majority of its customers will never be targeted by such attacks.

Apple threat notifications are designed to inform and assist users who may have been individually targeted by mercenary spyware attacks, probably because of who they are or what they do. Such attacks are vastly more sophisticated than regular cybercriminal activity, as mercenary spyware attackers apply exceptional resources to target a very small number of specific individuals and their devices. Mercenary spyware attacks cost millions and often have a short shelf life, making them much harder to detect and prevent. The vast majority of users will never be targeted by such attacks.

-- Apple Support

Pegasus infection in Serbia shows the threat is real

The warnings in Germany come shortly after researchers documented another case of mercenary spyware targeting a prominent public figure in Europe.

As we reported in October, Citizen Lab and the SHARE Foundation confirmed that the iPhone of Vladan Đokić, rector of the University of Belgrade and a supporter of Serbia's student-led pro-democracy movement, had been infected with Pegasus spyware.

Researchers established the infection with high confidence, determining that the attack exploited a zero-click vulnerability requiring no interaction from the victim.

The investigation also identified anti-corruption investigator Rade Bajić as another potential target. Bajić received an Apple spyware notification in August, although forensic analysis of his device was still ongoing when the findings were published.

In Đokić's case, researchers found forensic evidence confirming the compromise.

There is currently no publicly available evidence linking the Serbian attacks to the latest warnings in Germany, or establishing that Pegasus was used against German lawmakers.

Apple recently patched a flaw exploited in targeted attacks

The latest warnings also come amid Apple's continuing efforts to address vulnerabilities exploited in sophisticated attacks against specific individuals.

In late October, Apple released security updates for older iPhones and iPads, extending protection against a previously exploited CoreGraphics vulnerability.

Tracked as CVE-2026-86950, the flaw could let attackers execute malicious code by getting a vulnerable device to process a specially crafted file.

Apple previously acknowledged reports that the vulnerability may have been exploited in extremely sophisticated attacks against specific individuals.

The company has not said who was behind those attacks, who was targeted, or whether spyware was involved.

There is also no confirmed connection between that vulnerability and the latest spyware warnings sent to German officials.

The developments highlight, yet again, the importance of keeping devices updated – particularly for people at heightened risk of targeted surveillance.

What to do if Apple warns you about spyware

For people who receive such a warning:

• Verify the notification. Sign in directly at account.apple.com to check whether Apple has issued a genuine threat warning
• Seek expert assistance. Contact a qualified security specialist before taking actions that could destroy forensic evidence
• Update your device. Install the latest security updates, unless a specialist recommends preserving the device for forensic analysis
• Consider Lockdown Mode. Apple's optional security feature restricts certain functions to reduce exposure to sophisticated attacks (although it cannot remove an existing infection)
• Secure your accounts. Change important passwords from a trusted device, enable two-factor authentication, and review account access
• Consider replacing the phone. For individuals facing a serious threat, the BSI also recommends considering a replacement device and potentially a new phone number
• Check messaging apps. Review linked devices and enable additional account protections, including WhatsApp's two-step verification and Signal's registration lock

For peace of mind, use independent security software to help detect malicious links and downloads, and other threats that may accompany an attack.

On iPhones and iPads, you can enable Lockdown Mode under Settings → Privacy & Security → Lockdown Mode.

Apple also recommends seeking specialist help if you receive a threat notification. Organizations such as Access Now provide digital security assistance to people at risk.

And remember that genuine Apple threat notifications never ask recipients to install software, open attachments, or disclose passwords and verification codes.

On topic:

Pegasus spyware infects iPhone of Serbian university rector who supported student protests

Apple patches older iPhones against ‘extremely sophisticated’ attacks leveraging CoreGraphics flaw

Apple warns high-risk people in 92 countries they may be targeted by spyware