German lawmakers receive Apple warnings of possible iPhone spyware

Germany treats Apple spyware warnings as a serious security incident

Germany’s Federal Office for Information Security, the BSI, has warned members of the Bundestag and other unnamed public figures after they received Apple threat notifications indicating they may have been targeted by government-backed spyware. The alerts were issued days after Apple began notifying affected iPhone users.

Government spokesperson Stefan Kornelius said Berlin was taking the incident and the warning “very seriously”. He did not identify the officials targeted or say whether Chancellor Friedrich Merz was among those who received a notification.

Apple sends threat notifications when it believes an individual may have been targeted by highly sophisticated spyware. The company does not attribute an attack to a particular government and does not state that a device was definitely compromised. The BSI therefore advised recipients to assume that their device may have been compromised.

Why the alerts merit immediate attention

Government-backed spyware can extract highly sensitive material from a phone, including messages and location data. Such tools may exploit zero-click vulnerabilities, allowing an attacker to gain access without requiring the recipient to open a file, follow a link or otherwise interact with a message.

The latest round of Apple notifications was not confined to Germany. Beirut-based filmmaker Radwan Mortada said he received an alert stating that Apple had detected “another attack against your device”, following a spyware attack against him in 2021. Apple said in the notice he received that the new batch of alerts was sent to users in 99 countries.

Neither the operator behind the campaign nor the spyware used has been identified. The episode nonetheless points to the continuing market for commercial surveillance tools, commonly described as mercenary spyware. Governments often obtain these capabilities from private suppliers rather than developing them in-house.

Commercial spyware remains a public-sector risk

Israel’s NSO Group is among the best-known vendors in this market through its Pegasus spyware. Germany’s federal criminal police office, the BKA, reportedly bought access to Pegasus in 2019. That history adds context to the current concern, even though no connection between Pegasus and the new Apple notifications has been established.

For organisations whose executives, officials or staff receive a threat notification, the practical implication is to treat it as a potential device-compromise event. Incident-response procedures should account for the possibility that a targeted phone was accessed without any visible action by its user.