The German government’s spyware warning has reached lawmakers and public figures after Apple alerted iPhone users to possible targeting. Germany’s federal cybersecurity office, BSI , said in a weekend notice that members of the Bundestag and other prominent individuals had received Apple threat notifications. The alerts were part of a batch sent to users in 99 countries .
Key takeaways
BSI identified Bundestag members among Apple alert recipients.
Zero-click spyware can attack phones without user interaction.
Apple alerts signal possible targeting, not confirmed compromise.
Germany’s BKA reportedly obtained Pegasus access in 2019.
German government’s spyware warning prompts outreach
BSI warned politicians and public figures about government-backed spyware after learning of the Apple notifications. Digital Minister Karsten Wildberger said the agency had contacted affected people and advised them on protecting their devices.
Wildberger said BSI had “reacted extremely quickly.” He cautioned against drawing conclusions about the precise nature of the incident and said he would not necessarily attribute it to an artificial intelligence attack, noting that spyware had targeted phones for some time.
Government spokesperson Stefan Kornelius said Berlin was “taking the incident and the warning very seriously.” He did not identify targets within the federal government, including whether Chancellor Friedrich Merz was among them.
Zero-click exploits can bypass clicks and downloads
Zero-click exploits allow spyware to attack a device without requiring its owner to follow a link or open a file. Such attacks can operate almost invisibly, while spyware can steal messages, location information and other sensitive data.
Surveillance software can also capture photographs, keyboard input, calls and audio recorded through a device’s microphone. Other installation methods include malicious email attachments, fraudulent links, untrusted apps and vulnerabilities in outdated software.
Apple threat notifications go to people the company believes may have been targeted. Apple does not identify a government responsible for an attack or establish through the notification that a phone was successfully compromised.
BSI nevertheless advised recipients that they “should therefore assume that their device may have been compromised.” That guidance accompanied the German government’s spyware warning.
The alerts extended beyond Germany. Radwan Mortada , a Beirut-based filmmaker, wrote on X that Apple had notified him of “another attack against your device.” He had previously been targeted by spyware in 2021. The notification he received said Apple’s latest round of alerts covered users across 99 countries.
Private spyware vendors and Germany’s Pegasus history
Governments often purchase surveillance tools from private suppliers rather than build them themselves. These businesses are commonly described as mercenary spyware vendors; Israel’s NSO Group, which sells Pegasus, is the best-known example.
The targeting of political figures sits alongside a growing number of spyware attacks against members of civil society. Governments use spyware for surveillance, while criminals and stalkers also use such software to collect information without a device owner’s knowledge or consent.
Germany’s own federal law enforcement agency, the BKA , reportedly purchased access to Pegasus in 2019.
Article produced with the assistance of artificial intelligence and reviewed by the editorial team.
