German foreign policy staffers among mercenary spyware targets warned by Apple
Apple detected targeted mercenary spyware attacks and has sent threat notifications since October 29 to targets in 99 countries; in Germany they include Bundestag lawmakers, federal government members, and foreign policy staffers. Germany's BSI told recipients to assume their iPhones may be compromised and replace them. The attacker and the spyware vendor remain unknown.
What happened
Apple detected targeted mercenary spyware attacks and has been sending threat notifications since October 29 to victims in 99 countries. In Germany, the warnings reached Bundestag lawmakers, federal government members, and foreign policy staffers. Germany's cybersecurity agency BSI told each recipient to assume their iPhone may be compromised and replace it.
Why it matters
The spyware can steal messages, location data, and other sensitive information from phones, often without requiring the victim to click anything. The targets belong to Germany's political elite, which points to political espionage risk. The BSI does not know how many devices were actually infected, nor who the attacker or the spyware vendor is.
What to do
Anyone who received the warning should treat the iPhone as compromised, replace it immediately, and engage the security team. Check whether your organization's leaders and staffers received Apple threat notifications and apply the same protocol.
For the technical team
- Affected
- iPhones de membros do Bundestag e do governo federal da Alemanha e de um cineasta, visados por spyware mercenário detectado pela Apple · iPhones of Bundestag members and German federal government officials, foreign policy staffers, and journalists, plus targets in 99 countries, including Beirut-based filmmaker Radwan Mortada. iOS versions not specified in the sources.
- Exploitation
- Targeted attacks detected by Apple, with notifications sent since October 29, confirmed by Digital Minister Karsten Wildberger. The BSI, Financial Times, TechCrunch, and The Record report the campaign. The number of actual infections, the attacker, the spyware vendor, and the total number of targets remain unknown.
- Fix
- No software fix applies. The BSI sent a letter telling each recipient to assume the device may be compromised and replace it immediately; the letter went out within 24 hours of Apple's notifications, according to Wildberger.
- Vector
- Mercenary spyware against iPhones, which according to Apple often relies on zero-click exploits that can hack the phone without the victim clicking a link or opening a file. The notification indicates targeting; Apple does not confirm actual compromise.
- More details
- Der Spiegel reported the notifications reached members of a German delegation traveling with Chancellor Friedrich Merz in Asia. Green Party co-leader Franziska Brantner confirmed being targeted; Mortada, previously attacked in 2021, received a notice of another attack. Government spokesperson Stefan Kornelius said the incident is being taken very seriously, without saying who in the federal government was targeted. Cited context: NSO Group and Pegasus; the BKA reportedly bought Pegasus access in 2019; Citizen Lab linked the case to the Pall Mall Process meeting in Paris on November 11-12.
Timeline
New report shows foreign policy staff also received the warnings and that Apple alerted spyware targets in 99 countries.
TechCrunch reports that a filmmaker, alongside lawmakers, also received Apple's notification about a possible phone hack.
International press revisits the warning that German politicians' iPhones were targeted by spyware.
Want the next updates in your inbox? Get the daily edition →
See all 6 updates
Apple alerts began landing on October 29, confirmed by digital minister Karsten Wildberger; BSI told each recipient to assume their iPhone may be compromised.
Apple confirmed targeted attacks and has been sending threat notifications since October 29 to Bundestag members and federal government officials.
The German government warning, reported by the Financial Times, is circulating on social media.
Sources 7 sources
- @DeItaone @DeItaone
- @Kalshi @Kalshi
- @DarkWebInformer @DarkWebInformer
- @IntCyberDigest @IntCyberDigest
- @TheInsiderPaper @TheInsiderPaper
