Apple spyware alerts reach German MPs and journalists in 99 countries

Germany’s cybersecurity agency has told lawmakers who got Apple’s spyware warnings to treat their iPhones as possibly compromised. Several Bundestag members and other public figures have received the alerts since 29 October. The Federal Office for Information Security (BSI) said so in a note on its website.

In the alerts, Apple says it detected an attack using mercenary spyware. The BSI describes this as commercially built spyware that state actors have often used against specific people.

The agency said it does not know whether attackers broke into the phones or only tried to. It wrote to Bundestag members about the threat on 30 October and asked anyone affected to contact it directly.

“Those affected who have received a corresponding warning message from Apple should therefore assume that their device may have been compromised,” the BSI wrote (translated from German).

Government spokesperson Stefan Kornelius spoke to the Financial Times. He did not say which members of the federal government the attackers targeted.

The government is “taking the incident and the warning very seriously,” Kornelius told the FT.

What the BSI told them to do

Unless someone plans a forensic analysis, the BSI advises updating the phone’s software at once. It also recommends switching on Apple’s Lockdown Mode and keeping it on, even on a new device. Lockdown Mode makes new attacks harder, the agency said, but it does not remove an existing infection.

Anyone who judges the risk to be high should consider a new phone. They should also reset every account used on it and change their number. The BSI also listed a new passcode, new passwords, two-factor authentication and fresh PINs for Signal and WhatsApp.

Once inside a phone, this kind of spyware can read messages, including those in encrypted apps, the BSI said. It can also switch on the camera and microphone. In known cases it arrived through “zero-click” attacks that need no action from the victim. In October, Citizen Lab reported that an Israeli ad firm had used online ads to spread Candiru spyware.

Alerts in 99 countries

Apple has sent these alerts several times a year since 2021. They have reached users in more than 150 countries, according to its support page. It calls them high-confidence warnings, but it does not name attackers or regions.

Threat researcher Costin Raiu flagged the new round on X on 30 October. He wrote that it was separate from Apple’s August wave and tied to new attacks. The notice he shared says this round went to targeted users in 99 countries.

Raiu told Suzanne Smalley of The Record that he had checked several victims’ notifications.

“So far we do not see any signs of compromise in the logs that could confirm which actor is responsible for the breaches,” Raiu told The Record.

Two journalists go public

Ragıp Soylu, Turkey bureau chief for Middle East Eye, posted his alert on X on Thursday. He called it a “badge of honour” and his third this year.

“Likely state actors using mercenary spyware have repeatedly tried to hack my phone,” Soylu wrote.

Radwan Mortada, a Lebanese investigative journalist and documentary filmmaker, wrote on X on 30 October that he had received the warning the day before. He said NSO Group’s Pegasus spyware had targeted him in 2017 and 2021.

His alert came days after the release of The Trap, his Al Jazeera 360 film about the September 2024 pager explosions in Lebanon. Israel has confirmed it carried out those attacks against Hezbollah members. After the film came out, Mortada told The Record, Israeli soldiers entered his family home in southern Lebanon, looted it and blew it up.

He said he has no concrete evidence of a link to the spyware alert.

“The sequence of events, and their timing in relation to my investigative work, raise serious questions that cannot simply be dismissed,” Mortada told The Record.

“Targeting journalists with spyware poses a serious threat to freedom of the press and the confidentiality of their sources,” Mortada wrote on X (translated from Arabic).

John Scott-Railton, a researcher at Citizen Lab, told The Record that Apple made its alerts more visible in August.

“Apple Threat Notifications make accountability happen,” Scott-Railton said.

Pegasus in Germany

Germany’s federal police have bought Pegasus themselves. In 2021, the government told the Bundestag’s interior committee that the federal police office, the BKA, had bought a version of it, DW reported.

Spyware has reached European politicians before. In July, an EU lawmaker who investigated spyware abuse said attackers had hacked him with Pegasus. In Greece, victims of the Predator spyware are suing its maker for €8m.