Apple notifies users in 99 more countries of mercenary spyware attacks; Germany's BSI warns Bundestag members

Linha do tempo

1. securityonline.info ↗ · pub. 03/11/2026 11:56 · coletado 04/11 08:52

   Apple Mercenary Spyware Notifications Target Journalists Across 99 Countries

   ler a análise desta fonte ocultar

   Apple has issued threat notifications to targeted individuals in 99 countries, warning of sophisticated mercenary spyware campaigns. The alerts have disproportionately reached journalists with histories of prior device compromise, including Middle East Eye bureau chief Ragip Soylu, who received three separate warnings in 2026, and Lebanese filmmaker Radwan Mortada, a previous Pegasus zero-click victim. No definitive attribution to a specific spyware vendor or state sponsor has been established from available forensic evidence. Apple withholds technical details of the notifications to prevent attackers from reverse-engineering detection methods and adapting their exploits.

   Technical Details

   The campaigns reportedly leverage zero-click exploits capable of compromising iPhones without any user interaction, consistent with prior mercenary spyware tooling such as Pegasus. Mortada's case highlights a suspicious temporal link between his documentary on the 2024 pager explosions, a subsequent military raid on his family home, and the spyware notification, though investigators found no confirmed technical correlation between the physical and digital incidents. Apple deliberately limits disclosure of indicators of compromise to preserve the integrity of its detection capabilities against well-resourced exploit brokers.

   Remediation

   Recipients of Apple threat notifications are advised to immediately enable Lockdown Mode, which independent testing shows effectively blocks sophisticated zero-click payloads. Users should verify the authenticity of any notification through their official Apple Account and follow Apple's threat notification guidance. Organizations supporting at-risk individuals, such as journalists and activists, should incorporate mobile threat hunting and operational security practices to mitigate exposure to state-grade spyware.

2. securityaffairs.com ↗ · pub. 03/11/2026 03:24 · coletado 03/11 06:00

   Apple mercenary spyware threat notifications reach Bundestag members and German officials; BSI urges assuming compromise

   ler a análise desta fonte ocultar

   Since October 29, 2026, several members of the German Bundestag, federal government officials and other public figures have received Apple threat notifications warning of an attack with so-called mercenary spyware. Germany's BSI does not know whether the alerts reflect successful compromises or only attempted attacks, and advises recipients to assume their device may be compromised. Digital minister Karsten Wildberger confirmed the warnings on ARD. The BSI wrote to Bundestag members on October 30, 2026. The alerts were not limited to Germany: Beirut-based filmmaker Radwan Mortada reports that Apple sent the latest warnings to users in 99 countries. Nobody has publicly attributed the attacks to a vendor or a government.

   Technical Details

   • Mercenary spyware is commercially developed, advanced surveillance software typically used by state actors against specific individuals. It can infect devices through zero-click attacks, and victims usually notice nothing.
   • A compromised phone lets attackers read messages (including in encrypted apps), access calls, contacts, calendars and location, and switch on the camera and microphone.
   • Apple does not name the governments behind such attacks and does not confirm infection. The article names no spyware family, CVE or IOC.
   • Mortada's post references vendors like NSO Group and Pegasus in general terms, and he was previously targeted in 2021. This is not attribution for the current campaign.

   Remediation

   • Update the operating system immediately, unless a forensic analysis is planned.
   • Consider enabling Lockdown Mode. It makes new attacks harder but does not remove an existing infection.
   • If the risk is high, replace the device, reset all accounts used on it and consider changing the phone number. Set a new passcode, change the Apple account and email passwords, and ensure two-factor authentication is enabled.
   • Enable Signal's registration lock and WhatsApp's two-step verification with new PINs, and remove unrecognized linked devices.
   • Report received warnings to the BSI Service Center. A genuine Apple warning never asks you to click links, open files, install apps or profiles, or share passwords and codes.
3. techcrunch.com ↗ · pub. 02/11/2026 16:45 · coletado 02/11 17:00

   Germany's BSI warns Bundestag members of possible government-backed spyware compromise after Apple threat notifications

   ler a análise desta fonte ocultar

   Germany's federal cybersecurity office (BSI) warned that members of the Bundestag and other unnamed prominent individuals received Apple threat notifications saying their iPhones may have been targeted by government-backed spyware. A government spokesperson said Berlin is taking the incident "very seriously" but did not say who was targeted, including whether Chancellor Friedrich Merz is among them. Apple's latest batch of notifications reportedly went to users in 99 countries, and a Beirut-based filmmaker, Radwan Mortada, also received one. The actor and the sponsoring government behind this round of attacks are unknown.

   Technical Details

   • Apple sends threat notifications periodically to users it believes were targeted by spyware. It does not attribute attacks to specific governments and does not confirm whether a device was actually compromised.
   • Such spyware often relies on zero-click exploits and can steal messages, location data and other sensitive information. The article does not confirm the exploit used in this campaign.
   • The article names no CVEs, IOCs or malware family for this campaign.

   Remediation

   • The BSI advises that anyone who receives an Apple threat notification should assume the device may have been compromised.
4. gbhackers.com ↗ · pub. 02/11/2026 07:24 · coletado 02/11 08:00

   Apple sends new round of mercenary spyware threat notifications to users in 99 countries

   ler a análise desta fonte ocultar

   Apple has begun sending a new wave of threat notifications to users in 99 countries, warning of targeted mercenary spyware attacks, according to researcher Costin Raiu. The wave is separate from the August round, which covered 110 countries, and is tied to new attacks. Apple says it has notified users in over 150 countries in total since its program began in 2021. The notice names no spyware vendor, vulnerability, delivery mechanism or responsible government.

   Technical Details

   • Apple describes the alerts as high-confidence warnings, but an alert does not prove the device was compromised, and Apple admits its investigations cannot be absolutely certain.
   • Targets are highly selective and may be chosen for their identity or professional activities.
   • The country counts from separate rounds should not be added together to estimate unique affected countries.
   • The article cites the unrelated Graphite spyware case against journalists, which used an iMessage zero-click exploit (CVE-2025-43200) that was fixed in an iOS update. Nothing links Graphite to this wave.

   Remediation

   • Verify alerts by signing in to your Apple Account manually, where a notification banner appears. Alerts also arrive by email and on supported iPhones.
   • Enable Lockdown Mode and seek specialist help, such as Access Now's Digital Security Helpline (available 24/7).
   • Genuine Apple notifications never ask for passwords, verification codes, app installs, configuration profiles or file downloads. Treat any such request as suspicious.
5. cyberscoop.com ↗ · pub. 30/10/2026 14:07 · coletado 30/10 15:00 primeiro registro

   Apple sends mercenary spyware threat notifications to users in 99 countries, bringing the total to over 150

   ler a análise desta fonte ocultar

   Apple has sent a new round of threat notifications to users in 99 countries who were targeted by mercenary spyware. This brings the total to more than 150 countries notified to date. Recipients include journalists and documentary filmmakers. Apple does not attribute the attacks to any specific attacker or region. The Citizen Lab and Access Now called the batch significant, and Access Now said repressive states continue to use such tools against civil society and opposition figures. The notifications arrive shortly before the final negotiation rounds on industry standards for commercial hacking tools under the voluntary Pall Mall Process. Apple's previous major batch was sent in August.

   Technical Details

   • The article names no spyware family, vulnerability, exploit chain or IOC.
   • Apple describes the attacks as extremely costly, sophisticated and worldwide in nature.
   • John Scott-Railton (The Citizen Lab) cautioned that not receiving a notification does not rule out an infection.

   Remediation

   • Enable Lockdown Mode, as Apple recommends and Scott-Railton endorses.
   • Contact Access Now if you receive a notification.
   • Be cautious of companies that offer paid solutions to spyware infections (Scott-Railton).