Officials in Berlin are responding with heightened concern following the distribution of Apple's spyware alerts to members of the Bundestag and other prominent figures. Since 29 October, the alerts have circulated among lawmakers and public personalities across 99 nations, with journalists in Turkey and Lebanon among those who have made their warnings public.
The Federal Office for Information Security (BSI) has instructed affected lawmakers to regard their iPhones as potentially compromised. In a statement posted on 30 October, the agency notified Bundestag members of the threat and urged those affected to reach out directly. According to the BSI, Apple detected an attack employing commercially developed spyware that state-sponsored actors have frequently deployed against specific targets.
The agency clarified that it remains uncertain whether attackers successfully penetrated the devices or merely attempted to do so. In its communication to legislators, the BSI stated:
Those affected who have received a corresponding warning message from Apple should therefore assume that their device may have been compromised
Federal Office for Information Security (BSI)
When speaking with the Financial Times, government spokesperson Stefan Kornelius declined to identify which federal government members were targeted by the attackers. He emphasized that the administration is "taking the incident and the warning very seriously."
Recommended protective measures
The BSI has outlined a series of steps for those who received warnings. Unless individuals plan to conduct forensic examination, the agency recommends immediately updating the device's operating system. Enabling Apple's Lockdown Mode and maintaining it continuously—even when switching to a replacement device—is also advised. While Lockdown Mode increases the difficulty of launching fresh attacks, the BSI cautioned that it cannot eliminate infections already present on a device.
For those assessing their risk as substantial, acquiring a new device may be prudent. Additional precautions include resetting all accounts previously accessed on the compromised phone, obtaining a new telephone number, and establishing a new passcode, fresh passwords, updated two-factor authentication, and new PINs for Signal and WhatsApp.
Once installed on a device, this category of spyware can intercept messages across encrypted applications, activate cameras and microphones remotely, and gain access to sensitive communications. The BSI noted that documented instances have involved "zero-click" attacks requiring no user interaction. In October, Citizen Lab disclosed that an Israeli advertising company had distributed Candiru spyware through online advertisements.
Global distribution and attribution challenges
Apple has issued these notifications multiple times annually since 2021, reaching users across more than 150 countries according to its support documentation. The company characterizes them as high-confidence warnings but refrains from identifying specific attackers or geographic regions.
Security researcher Costin Raiu brought attention to the current alert wave on 30 October via X, noting its distinction from Apple's August notifications and its connection to newly identified attacks. The notification he shared indicates that this wave targeted users across 99 countries.
When discussing his findings with Suzanne Smalley of The Record, Raiu explained:
So far we do not see any signs of compromise in the logs that could confirm which actor is responsible for the breaches
Costin Raiu
Journalists report targeting
Ragıp Soylu, who leads Middle East Eye's operations in Turkey, shared his alert on X on Thursday, describing it as a "badge of honour" and noting it represented his third such warning this year. He wrote: "Likely state actors using mercenary spyware have repeatedly tried to hack my phone."
Lebanese investigative journalist and documentary filmmaker Radwan Mortada posted on X on 30 October that he had received the warning the previous day. He referenced prior targeting by NSO Group's Pegasus spyware in 2017 and 2021.
Mortada's alert arrived shortly after the release of The Trap, his Al Jazeera 360 documentary examining the September 2024 pager explosions in Lebanon. Israel has acknowledged responsibility for those operations targeting Hezbollah. Following the film's release, Mortada disclosed to The Record that Israeli soldiers subsequently entered his family residence in southern Lebanon, removed belongings, and destroyed the structure.
While Mortada acknowledged lacking definitive proof linking these events to the spyware alert, he emphasized the significance of their sequence and timing. He told The Record: "The sequence of events, and their timing in relation to my investigative work, raise serious questions that cannot simply be dismissed."
On X, Mortada also stated: "Targeting journalists with spyware poses a serious threat to freedom of the press and the confidentiality of their sources."
John Scott-Railton, researcher at Citizen Lab, told The Record that Apple enhanced the visibility of its threat notifications beginning in August. He remarked: "Apple Threat Notifications make accountability happen."
Pegasus use in Germany
Germany's federal law enforcement has itself procured Pegasus technology. In 2021, the government disclosed to the Bundestag's interior committee that the federal police office, the BKA, had acquired a version of the software, according to reporting by DW.
Spyware incidents have previously affected European political figures. An EU lawmaker investigating spyware misuse reported being compromised with Pegasus in July. In Greece, individuals targeted by Predator spyware are pursuing legal action against its manufacturer for €8 million.
Source: The Next Web
