Apple Warns Lawmakers and Journalists Across 99 Countries of Mercenary Spyware Attacks

Apple has dispatched a fresh round of mercenary spyware notifications to iPhone users across 99 countries, prompting Germany's federal cybersecurity agency to instruct targeted lawmakers to treat their handsets as potentially breached.

The notifications, which Apple began issuing on Oct. 29, alert recipients that their devices were singled out by commercial-grade surveillance software typically deployed by state-backed entities. The alerts reached several members of the German Bundestag and other public figures, according to reporting by The Next Web .

In an advisory published on its website, Germany's Federal Office for Information Security (BSI) said it notified lawmakers on Oct. 30 and asked anyone who received Apple's message to contact the agency directly. The BSI stated that while it does not yet know whether attackers successfully penetrated the devices or merely attempted to do so, recipients should operate under the assumption that their phones may have been compromised.

German government spokesperson Stefan Kornelius told the Financial Times that federal authorities are taking the incident and warning with high urgency, though he declined to specify which government officials received the alert.

Commercial mercenary spyware typically infiltrates mobile operating systems via zero-click exploits that require no interaction from the victim. Once embedded, the software can access microphone and camera feeds and extract communications, including message threads from encrypted applications such as Signal and WhatsApp.

For individuals who do not plan to submit their phones for forensic analysis, the BSI recommended updating iOS immediately and enabling Apple's Lockdown Mode, keeping the feature active on both current and replacement devices. The agency cautioned that while Lockdown Mode significantly hardens attack surfaces against future intrusions, it does not remove an existing infection. High-risk targets were advised to replace their hardware, change their phone numbers, reset all associated digital accounts, and configure new authentication credentials and application PINs.

Apple has distributed high-confidence threat notifications periodically since 2021, informing users in more than 150 countries without publicly naming the responsible vendors or sponsoring governments. Threat researcher Costin Raiu, who flagged the latest campaign on Oct. 30, noted that the notifications represent an attack wave distinct from an earlier cycle observed in August. Raiu told cybersecurity outlet The Record that while he reviewed notifications from several victims, device logs have not yet yielded indicators confirming which specific actor led the campaign.

Several journalists have confirmed receiving alerts in the latest wave. Ragıp Soylu, Turkey bureau chief for Middle East Eye, disclosed that he received his third notification of the year, attributing the attempts to suspected state actors. Lebanese investigative journalist Radwan Mortada also reported receiving an alert shortly after the release of a documentary examining the September 2024 pager detonations in Lebanon, though he stated he has no concrete evidence directly linking the surveillance attempt to his reporting.

The incident highlights ongoing friction surrounding commercial surveillance tools across Europe. While Germany's Federal Criminal Police Office previously acknowledged purchasing a version of NSO Group's Pegasus software in 2021, European institutions have faced recurring intrusion attempts, including Pegasus compromises reported by European Union lawmakers earlier this year.