Mercenary Spyware Targets German Lawmakers’ iPhones, BSI Warns

Germany’s Federal Office for Information Security (BSI) has warned members of the Bundestag and of the federal government that their iPhones may have been targeted by mercenary spyware. Digital Minister Karsten Wildberger confirmed the warning on Sunday, November 1, after Apple sent threat notifications to the affected devices starting October 29.

Wildberger told ARD’s “Bericht aus Berlin” that Apple had reported “that certain devices may have been compromised with so-called spyware,” according to Tagesschau. He said the BSI reacted quickly and wrote to everyone affected with instructions. He did not say who received the alerts, how many people were involved or who might be behind the attack.

What the BSI Letter Says About the Mercenary Spyware Alerts

According to the BSI letter seen by ARD, the Apple notifications said an attack with mercenary spyware had been detected that aimed to compromise the iPhone. The agency wrote that it currently has no further information on the specific cause or background of the notifications.

The BSI advised recipients to “assume, as a precaution, that the device may have been compromised.” It warned that this kind of spyware can give attackers access to messages, including those in encrypted apps, as well as calls, contacts, calendars and location data, and can switch on the microphone and camera.

Wildberger called the situation “purely speculative” for now and said he would not necessarily link it to an AI-driven attack, since spyware on phones has existed for years. He added that the case is still a cause for great concern. There is no confirmation yet that any device was actually infected.

Part of a Global Wave in 99 Countries

The German alerts appear to be part of a wider round of Apple warnings. Apple told recipients that this notification went to targeted users in 99 countries and that it has now notified users in more than 150 countries in total, CyberScoop reported. Journalists and documentary filmmakers were among those who received it.

“The extreme cost, sophistication, and worldwide nature of mercenary spyware attacks make them some of the most advanced digital threats in existence today,” Apple said, adding that it does not attribute the attacks to any specific attackers or regions. France’s national cyber agency CERT-FR has also logged the October 29 campaign in its list of known Apple notification waves.

The previous large round came in August, when Apple warned users in 110 countries. Mercenary spyware such as NSO Group’s Pegasus is expensive, is usually sold to governments and is aimed at a small number of high-value people, including politicians, officials, journalists and activists.

What It Means for iPhone Users

Apple says its threat notifications are high-confidence warnings that a specific person was deliberately targeted, but they do not prove that an attack succeeded. Most iPhone owners will never receive one. Genuine alerts appear directly on the iPhone and by email, and they never ask users to click links, install apps or share passwords, according to Apple’s threat notifications support page.

Recipients are advised to turn on Lockdown Mode and to seek expert help, for example from the digital rights group Access Now. For everyone else, the best defense remains installing updates quickly, such as the recent iOS 27.2 security update, since many attacks rely on known flaws in older software.

Spyware campaigns against iPhones have grown more varied this year, from targeted state-level tools to DarkSword attacks spread through malicious ads. Neither the BSI nor Apple has said whether more details on the German case will be released.