The German government has warned politicians and public figures that they may be targets of government-backed spyware attacks. Several days earlier, Apple began sending notifications to victims, alerting them that their iPhones may have been hacked.
The German Federal Office for Information Security (BSI) stated in a notice over the weekend that it had learned German federal parliament members, along with other unnamed prominent individuals, received warnings from Apple indicating they may be targeted by cyberattacks.
According to the Financial Times, German government spokesperson Stefan Kornelius said that Berlin is “taking this incident and warning very seriously,” but he did not specify which individuals within the federal government were affected, nor did he reveal whether German Chancellor Friedrich Merz was among them.
Apple periodically sends threat notifications to individuals it believes may have been targeted by spyware. This type of spyware can steal information, location data, and other sensitive data from a phone. Such software often exploits zero-click vulnerabilities, enabling it to compromise devices almost without the user’s knowledge, as victims do not need to click on links or open files.
Apple does not attribute attacks to any specific government, nor does it confirm whether a person's device has actually been compromised. Therefore, BSI states that anyone who receives an Apple threat notification "should assume their device may have been breached."
Others outside Germany have also received Apple’s recent threat alert. Beirut filmmaker Radwan Mortada posted on X that he received a new threat notification warning that Apple had detected “another attack targeting your device”; he had previously been targeted by spyware in 2021.
It is still unclear who is behind this latest spyware attack or which government orchestrated these targeted campaigns. According to the notice received by Mortada, Apple stated that the latest batch of threat notifications has been sent to users in 99 countries.
This incident once again highlights the elusive business model behind the growing number of attacks targeting members of civil society. Governments rarely develop these tools themselves; instead, they more often purchase them from private vendors, commonly referred to as "mercenary spyware" manufacturers. The most well-known of these is Israel’s NSO Group, which sells the controversial Pegasus spyware. Reports also indicate that Germany’s Federal Criminal Police Office (BKA) purchased access to Pegasus in 2019.