Spyware on iPhone, Apple warns users in 99 countries: German parliamentarians also involved

Applehas sent a new round of security notifications to people potentially targeted by mercenary spyware, with reports covering 99 countries. The recipients also included German parliamentarians, which prompted the federal authorities to intervene. Alerts don't automatically prove that a device has been compromised, but they indicate a risk that should be taken seriously. The story brings attention to targeted cyber attacks against public figures, journalists and other particularly exposed subjects.

Spyware on iPhone: Alerts reach 99 countries

spyware on iPhone - The new reports from Apple concern possible attacks conducted through mercenary spyware, surveillance tools used to target selected people rather than spreading indiscriminately among users. The number of 99 countries emerges from the content of a notification shared publicly by Radwan Mortada, a director based in Beirut.

In the communication, Apple also specifies that, since 2021, its threat notifications have reached users in over 150 countries. This is data about the geographic distribution of alerts, not a count of actual breached devices.

According to theApple support documentation, these operations can require investments of millions of dollars and generally involve a small number of targets. The most exposed categories include politicians, diplomats, activists and journalists. Apple considers its reports highly reliable, although it specifies that they do not represent an absolute confirmation that the compromise has occurred.

German parliamentarians targeted by attacks

The situation has taken on particular relevance in Germany, where since 29 October 2026 several members of the Bundestag and other public figures have received notifications on their Apple devices.

TheBSI, the German Federal Office for Information Security, urged recipients to treat devices as potentially compromised. On October 30, the organization wrote to parliamentarians to explain the risks and precautionary measures, asking those who had received the warning to contact the office directly.

However, authorities have not determined whether all notifications correspond to successful intrusions or attempted attacks detected before the compromise.

As reported byFinancial Times, government spokesman Stefan Kornelius said that Berlin is taking the incident extremely seriously and is working to clarify the circumstances. He did not confirm whether Chancellor Friedrich Merz was among the recipients.

The possible use of zero-click vulnerabilities

spyware on iPhone - According to the Financial Times, the attacks exploited a zero-click vulnerability. This technique allows you to target a device without requiring the victim to open links, download attachments, or perform any other actions.

In the described scenario, the attackers would have only needed to know the target's phone number. However, the specific mechanism and the actual compromise of individual devices are not confirmed by the available information.

The BSI warns that successfully installed spyware can allow access to messages, including communications from encrypted applications, calls, contacts, calendar and location. It can also allow the activation of the microphone and camera. These are potential capabilities of surveillance tools, not evidence that they have been used in all reported cases.

The testimony from Lebanon and the previous Pegasus

One of the notices was posted on X by Radwan Mortada, a filmmaker based in Beirut. The communication specifies that the new report does not constitute a repetition of the one received on November 23, 2021, but concerns a further attack detected against your device.

Mortada said he had already been targeted with Pegasus in 2017 and 2021. He does not know the identity of those responsible for the most recent episode and does not know whether there could be a connection with the investigative documentary on the beeper explosions in Lebanon on which he worked.

The government authority, if any, responsible for this wave of attacks has not been publicly identified. Pegasus, developed by NSO Group, remains one of the best-known examples of commercial spyware.TechCrunchrecall that in 2019 the BKA, the German federal criminal police, also purchased access to this tool. This precedent does not demonstrate any involvement in the current episode.

How to recognize an authentic notification from Apple

Threat notifications can be imitated through phishing attempts. For this reason, Apple provides various channels through which to verify its authenticity.

A legitimate alert can appear on your iPhone, on the lock screen, or in Settings. It may also be delivered to addresses associated with your Apple Account via a message from threat-notifications@email.apple.com. Further feedback is available by logging directly into your account on the account.apple.com website, where any notice appears at the top of the page.

Apple does not require you to install applications or profiles, open attachments, follow links, or provide passwords and verification codes through these notifications. If in doubt, it is therefore advisable to type the address of the Apple site into the browser yourself, avoiding using links contained in suspicious communications.

What to do after receiving a threat alert

The BSI recommends that recipients take precautionary measures immediately. These include updating the operating system, unless a specialist analysis of the device is envisaged, for which it may be necessary to preserve its status.

Other indications include changing the unlock code and passwords for your Apple Account, email and other services used on your phone. It's important to make sure you have two-factor authentication enabled and check any devices linked to your accounts.

For Signal it is suggested to activate registration blocking, while for WhatsApp two-step verification is indicated. Unrecognized connected devices must be removed. In cases considered particularly risky, replacing the telephone and number used may also be considered.

Another measurement is theIsolation modefrom Apple, accessible from Settings in the Privacy and Security section. This protection limits some features to reduce the possibility of new attacks, but does not eliminate spyware that may already be installed.

Restrictions include blocking most attachments in Messages and disabling links and previews. Incoming FaceTime calls are also blocked when you have not contacted that person in the previous 30 days. The mode can also be activated preventively by those who believe they are a high-risk target.

Finally, Apple recommends turning to digital security professionals. Among the resources indicated is the helpline of the non-profit organization Access Now, which operates 24 hours a day. For those who receive an authentic notification, the fundamental point is not to ignore it, while avoiding automatically considering it as evidence of a successful intrusion.

Editorial source consulted:iSpace.