Apple spyware alerts reach German lawmakers, BSI advises action

Apple has begun sending threat notifications to Bundestag lawmakers and other prominent figures that point to attacks using mercenary spyware, according to the Security Affairs report and corroborating statements from Germany’s Federal Office for Information Security (BSI). The BSI notes that the alerts appeared on devices from 29 October 2026 and that Apple does not indicate whether devices were actually compromised or merely targeted.

The report also cites Berlin’s digital minister, Karsten Wildberger, who said officials were warned and that the BSI had acted quickly to contact those affected. The BSI emphasises that the warnings do not confirm a successful infection and that the exact number of targeted individuals remains undisclosed.

The BSI’s practical guidance is explicit: recipients should assume their device may be compromised and take protective steps. Recommended actions include updating the operating system, enabling Lockdown Mode if a forensic analysis is not planned, and, in high-risk cases, replacing the device. Replacement entails resetting all accounts, potentially changing the phone number, and updating credentials and two-factor authentication.

The agency also urges enabling Signal registration lock and WhatsApp two-step verification, removing unrecognised linked devices, and contacting the BSI Service Centre to help quantify impact. Apple’s notices describe mercenary spyware as highly advanced and typically deployed by state actors via zero-click exploits, with attackers able to read messages, access calls, calendars and location, and even activate cameras and microphones.

The alert cautions that the warnings do not identify the attacker or ordering government, and notes that attacks have been observed in multiple countries beyond Germany.