German digital minister Karsten Wildberger confirmed at the weekend that members of the Bundestag and the federal government received Apple threat notifications warning that their iPhones may have been compromised by mercenary spyware. The alerts began reaching affected devices on 29 October, Wildberger said during an appearance on ARD's Bericht aus Berlin. The Federal Office for Information Security (BSI) had reacted quickly and written to everyone affected about what to do, he said, adding that the BSI advised those affected to assume, as a precaution, that their device may have been compromised because the alerts do not show whether an attack succeeded.
Apple's threat notifications are sent when the company believes a user has been individually targeted by mercenary spyware, which it describes as vastly more sophisticated than regular cybercriminal activity. The notifications appear on the iPhone's lock screen and in its settings, and are also sent by email. According to the BSI, such spyware can give attackers access to messages including those sent on encrypted apps, as well as to calls, contacts, calendars and location data. It can also switch on a phone's microphone and camera.
Neither Apple nor the German authorities have said who may be behind the attack. Wildberger did not say how many politicians had received the alerts, or who they were. The BSI could not immediately be reached for comment.
Apple has issued similar threat notifications to users in over 110 countries worldwide, warning of sophisticated state-sponsored mercenary spyware attacks targeting high-profile individuals including journalists, activists and NGO staff. The company emphasizes that these highly targeted operations are distinct from common cybercriminal activities, as they involve significant financial backing and professional resources designed to bypass standard security defenses. The targets typically include political figures, human rights defenders and members of the press. Public reports indicate these attacks are rarely random but focus on specific profiles motivated by political or strategic objectives. Neither Apple nor German authorities have attributed the attacks to specific actors or geographical regions.
Radwan Mortada, a Lebanese documentary filmmaker and investigative journalist, publicly confirmed receiving a threat notification. He said the latest Apple-confirmed attack comes days after the release of an investigative documentary he directed about September 2024 pager explosions in Lebanon. Mortada noted he was previously targeted by the powerful zero-click Pegasus spyware in 2017 and 2021. Turkey-based reporter Ragıp Soylu, Middle East Eye's Turkey bureau chief, also confirmed receiving the notification, saying it was likely the third such alert he had received this year. Soylu said he considers the hacks an "endorsement for the reporting I do."
Digital security experts say the notifications underscore the persistent threat of state-sponsored spyware targeting of political figures and investigative journalists worldwide. The incident highlights the challenges in attributing such sophisticated attacks and the need for heightened digital security awareness among high-profile individuals.
