Apple warns German MPs and ministers of mercenary spyware attacks

Members of Germany's Bundestag and federal government have received Apple threat notifications warning that their iPhones were targeted with mercenary spyware, and the country's cyber security agency, the BSI, has told them to assume their devices may be compromised. Digital Minister Karsten Wildberger confirmed the warnings on Sunday on ARD's Bericht aus Berlin.

Wildberger said there was "a notification from Apple that certain devices may have been compromised with so-called spyware", according to heise, and that the BSI had reacted very quickly and written to everyone affected. He told ARD that what exactly it involved was "purely speculative at this stage", and that it was nonetheless something that "causes us great concern".

Neither the government nor the BSI has said how many people received the alerts, who they are, or who is behind the attacks. Apple does not name attackers in its notifications.

What the BSI told recipients

The notifications began reaching German iPhones on 29 October, according to the BSI's letter as reported by heise. The agency advised recipients to assume, as a precaution, that their device may be compromised, because the alerts do not show whether an attack succeeded.

Der Spiegel, which reported that participants in Chancellor Friedrich Merz's trip to Asia were among those warned, quotes the BSI as saying that devices may be infected "without the involvement of those affected", for example through a prepared message that does not need to be opened, and that those affected usually notice nothing. John Scott-Railton of the University of Toronto's Citizen Lab, who shared the Spiegel report, said the targets included MPs, ministry officials and journalists, and summarised the BSI's advice to recipients as "assume zero-click attack".

What an Apple notification means

Apple calls its threat notifications "high-confidence alerts that a user has been individually targeted by a mercenary spyware attack". It does not attribute attacks to any attacker or region and does not say what triggers an alert. The German alerts began in the same week as a new round of notifications that Apple sent to people in 99 countries, CyberScoop reported on 30 October.

Scott-Railton pointed out that a notification arrives after a round of targeting has already happened, and that people in the same target pool who use Android phones receive no Apple alert at all.

What recipients should do

In a thread published after Apple's latest round, Scott-Railton advised recipients to confirm the alert in the iPhone's settings rather than through a link, to turn on Lockdown Mode, and not to wipe the phone before an expert has examined it, because a wiped device leaves investigators nothing to analyse. Civil society recipients can contact Access Now's helpline, which Apple also recommends.

The German government has not said whether it will publish the number of recipients or open an investigation into who targeted them.