Apple notifies users in 99 more countries of mercenary spyware attacks; Germany's BSI warns Bundestag members

Linha do tempo

1. techcrunch.com ↗ · pub. 02/11/2026 16:45 · coletado 02/11 17:00

   Germany's BSI warns Bundestag members of possible government-backed spyware compromise after Apple threat notifications

   ler a análise desta fonte ocultar

   Germany's federal cybersecurity office (BSI) warned that members of the Bundestag and other unnamed prominent individuals received Apple threat notifications saying their iPhones may have been targeted by government-backed spyware. A government spokesperson said Berlin is taking the incident "very seriously" but did not say who was targeted, including whether Chancellor Friedrich Merz is among them. Apple's latest batch of notifications reportedly went to users in 99 countries, and a Beirut-based filmmaker, Radwan Mortada, also received one. The actor and the sponsoring government behind this round of attacks are unknown.

   Technical Details

   • Apple sends threat notifications periodically to users it believes were targeted by spyware. It does not attribute attacks to specific governments and does not confirm whether a device was actually compromised.
   • Such spyware often relies on zero-click exploits and can steal messages, location data and other sensitive information. The article does not confirm the exploit used in this campaign.
   • The article names no CVEs, IOCs or malware family for this campaign.

   Remediation

   • The BSI advises that anyone who receives an Apple threat notification should assume the device may have been compromised.
2. gbhackers.com ↗ · pub. 02/11/2026 07:24 · coletado 02/11 08:00

   Apple sends new round of mercenary spyware threat notifications to users in 99 countries

   ler a análise desta fonte ocultar

   Apple has begun sending a new wave of threat notifications to users in 99 countries, warning of targeted mercenary spyware attacks, according to researcher Costin Raiu. The wave is separate from the August round, which covered 110 countries, and is tied to new attacks. Apple says it has notified users in over 150 countries in total since its program began in 2021. The notice names no spyware vendor, vulnerability, delivery mechanism or responsible government.

   Technical Details

   • Apple describes the alerts as high-confidence warnings, but an alert does not prove the device was compromised, and Apple admits its investigations cannot be absolutely certain.
   • Targets are highly selective and may be chosen for their identity or professional activities.
   • The country counts from separate rounds should not be added together to estimate unique affected countries.
   • The article cites the unrelated Graphite spyware case against journalists, which used an iMessage zero-click exploit (CVE-2025-43200) that was fixed in an iOS update. Nothing links Graphite to this wave.

   Remediation

   • Verify alerts by signing in to your Apple Account manually, where a notification banner appears. Alerts also arrive by email and on supported iPhones.
   • Enable Lockdown Mode and seek specialist help, such as Access Now's Digital Security Helpline (available 24/7).
   • Genuine Apple notifications never ask for passwords, verification codes, app installs, configuration profiles or file downloads. Treat any such request as suspicious.
3. cyberscoop.com ↗ · pub. 30/10/2026 14:07 · coletado 30/10 15:00 primeiro registro

   Apple sends mercenary spyware threat notifications to users in 99 countries, bringing the total to over 150

   ler a análise desta fonte ocultar

   Apple has sent a new round of threat notifications to users in 99 countries who were targeted by mercenary spyware. This brings the total to more than 150 countries notified to date. Recipients include journalists and documentary filmmakers. Apple does not attribute the attacks to any specific attacker or region. The Citizen Lab and Access Now called the batch significant, and Access Now said repressive states continue to use such tools against civil society and opposition figures. The notifications arrive shortly before the final negotiation rounds on industry standards for commercial hacking tools under the voluntary Pall Mall Process. Apple's previous major batch was sent in August.

   Technical Details

   • The article names no spyware family, vulnerability, exploit chain or IOC.
   • Apple describes the attacks as extremely costly, sophisticated and worldwide in nature.
   • John Scott-Railton (The Citizen Lab) cautioned that not receiving a notification does not rule out an infection.

   Remediation

   • Enable Lockdown Mode, as Apple recommends and Scott-Railton endorses.
   • Contact Access Now if you receive a notification.
   • Be cautious of companies that offer paid solutions to spyware infections (Scott-Railton).