Apple mercenary spyware threat notifications reach Bundestag members and German officials; BSI urges assuming compromise
Since October 29, 2026, several members of the German Bundestag, federal government officials and other public figures have received Apple threat notifications warning of an attack with so-called mercenary spyware. Germany's BSI does not know whether the alerts reflect successful compromises or only attempted attacks, and advises recipients to assume their device may be compromised. Digital minister Karsten Wildberger confirmed the warnings on ARD. The BSI wrote to Bundestag members on October 30, 2026. The alerts were not limited to Germany: Beirut-based filmmaker Radwan Mortada reports that Apple sent the latest warnings to users in 99 countries. Nobody has publicly attributed the attacks to a vendor or a government.
Detalhes técnicos
- Mercenary spyware is commercially developed, advanced surveillance software typically used by state actors against specific individuals. It can infect devices through zero-click attacks, and victims usually notice nothing.
- A compromised phone lets attackers read messages (including in encrypted apps), access calls, contacts, calendars and location, and switch on the camera and microphone.
- Apple does not name the governments behind such attacks and does not confirm infection. The article names no spyware family, CVE or IOC.
- Mortada's post references vendors like NSO Group and Pegasus in general terms, and he was previously targeted in 2021. This is not attribution for the current campaign.
Remediação
- Update the operating system immediately, unless a forensic analysis is planned.
- Consider enabling Lockdown Mode. It makes new attacks harder but does not remove an existing infection.
- If the risk is high, replace the device, reset all accounts used on it and consider changing the phone number. Set a new passcode, change the Apple account and email passwords, and ensure two-factor authentication is enabled.
- Enable Signal's registration lock and WhatsApp's two-step verification with new PINs, and remove unrecognized linked devices.
- Report received warnings to the BSI Service Center. A genuine Apple warning never asks you to click links, open files, install apps or profiles, or share passwords and codes.
Linha do tempo
-
Apple mercenary spyware threat notifications reach Bundestag members and German officials; BSI urges assuming compromise
ler a análise desta fonte ocultar
Since October 29, 2026, several members of the German Bundestag, federal government officials and other public figures have received Apple threat notifications warning of an attack with so-called mercenary spyware. Germany's BSI does not know whether the alerts reflect successful compromises or only attempted attacks, and advises recipients to assume their device may be compromised. Digital minister Karsten Wildberger confirmed the warnings on ARD. The BSI wrote to Bundestag members on October 30, 2026. The alerts were not limited to Germany: Beirut-based filmmaker Radwan Mortada reports that Apple sent the latest warnings to users in 99 countries. Nobody has publicly attributed the attacks to a vendor or a government.
Technical Details
- Mercenary spyware is commercially developed, advanced surveillance software typically used by state actors against specific individuals. It can infect devices through zero-click attacks, and victims usually notice nothing.
- A compromised phone lets attackers read messages (including in encrypted apps), access calls, contacts, calendars and location, and switch on the camera and microphone.
- Apple does not name the governments behind such attacks and does not confirm infection. The article names no spyware family, CVE or IOC.
- Mortada's post references vendors like NSO Group and Pegasus in general terms, and he was previously targeted in 2021. This is not attribution for the current campaign.
Remediation
- Update the operating system immediately, unless a forensic analysis is planned.
- Consider enabling Lockdown Mode. It makes new attacks harder but does not remove an existing infection.
- If the risk is high, replace the device, reset all accounts used on it and consider changing the phone number. Set a new passcode, change the Apple account and email passwords, and ensure two-factor authentication is enabled.
- Enable Signal's registration lock and WhatsApp's two-step verification with new PINs, and remove unrecognized linked devices.
- Report received warnings to the BSI Service Center. A genuine Apple warning never asks you to click links, open files, install apps or profiles, or share passwords and codes.