Ing. Calogero Bono
Apple has sent a new wave of threat notifications to users in 99 countries, warning them of a possible attack with mercenary spyware. In Germany, the notifications reached members of the Bundestag and other public figures, and the cybersecurity agency BSI has asked that the devices be considered unsafe. The first notifications date back to October 29. The case matters because it shows how active these tools still are and how hard it is to know who is behind them.
A few terms before we get into the facts. Mercenary spyware is very expensive surveillance software, developed by private companies and used against a handful of people. Pegasus is the best known, made by NSO Group. Zero-click refers to an attack that requires no action from the victim, neither a click nor opening a file. BSI is the German federal office for information security. Lockdown Mode is an Apple feature that reduces the device's attack surface.
What happened with Apple's notifications?
According to 9to5Mac, citing the Financial Times and TechCrunch, German politicians and officials began receiving the alerts last Thursday. Over the weekend the BSI issued an urgent warning.
As reported by HDblog, German authorities have opened investigations. The message some users received said the series of alerts had been sent in 99 countries.
What are the German government and the BSI saying?
The BSI explained that it became aware of alerts received by members of the Bundestag and other prominent people, who were not named. According to TechCrunch, anyone receiving the notification «should therefore assume that their device may have been compromised».
Government spokesperson Stefan Kornelius, reports the Financial Times, said the government takes «the incident and the warning very seriously». He did not say who was affected, nor whether Chancellor Friedrich Merz is among them.
What is a zero-click attack and why is it worrying?
Again according to the Financial Times, the attacks reportedly exploited a zero-click vulnerability. Knowing the target's phone number would be enough. This is information reported by the press, not confirmed by Apple.
TechCrunch notes that this kind of spyware can steal messages, location data and other sensitive information. Since no click is needed, user caution alone is not enough.
Who else received the alert?
Among the recipients outside Germany is Radwan Mortada, a filmmaker from Beirut. He shared the alert on X, where Apple spoke of «another attack against your device». He had already been targeted by Pegasus in 2017 and 2021.
Mortada says he does not know who is behind the new attempt, nor whether it is connected to an investigative documentary he directed.
How do Apple's threat notifications work?
The official Apple page explains that the alerts are high-confidence signals, although no investigation can offer absolute certainty. Apple relies only on internal information and does not explain what triggers them, so as not to help attackers.
Since 2021 the alerts have arrived several times a year and, according to Apple, have reached users in over 150 countries. They appear on the iPhone, by email and in a banner on account.apple.com.
What should you do if you receive a notification?
Apple recommends turning on Lockdown Mode and contacting experts, such as Access Now's Digital Security Helpline, available 24 hours a day. To verify that the alert is genuine, sign in to account.apple.com and check the banner at the top.
A genuine notification never asks you to click links, open files, install apps or profiles, or provide passwords or verification codes.
Good practices apply to everyone. Keep devices updated, use two-factor authentication, and install apps only from the App Store. On this topic you can also read about the new App Store rules.
Limits to know
It is not known who is behind the attacks or which governments may have orchestrated them. Apple does not attribute them and does not confirm whether a phone is actually compromised. HDblog points out that there is no established link between the alert and an actual compromise. The zero-click detail comes from a press report, not from Apple. What remains unclear is the outcome of the German investigation, the number of people affected and the vulnerability exploited.
What changes for those who work with digital tools
For a company, the direct threat remains remote, since Apple itself says the vast majority of users will never be targeted. The risk grows if the company has exposed people, such as executives, lawyers, journalists or anyone handling sensitive data. It is worth deciding in advance whom to contact and how to isolate a device, for example through a policy for company phones. Those managing shared accounts can start with the tools described in the guide to the Google Workspace Admin Console.
Our take
The case exposes a systemic weakness. Mercenary tools are sold by private companies and, as TechCrunch recalls, the German BKA reportedly bought Pegasus in 2019. An uncomfortable question remains – whoever buys these tools uses them against others. Apple is right to warn, but the opacity about its detection criteria leaves users with an alarm and no context. The BSI's advice to consider the phone compromised is prudent, yet it carries heavy weight for anyone who uses that device every day for work.
Frequently asked questions
What are Apple threat notifications?
They are alerts sent to people Apple believes have been targeted by mercenary spyware. They appear on the iPhone, by email and on account.apple.com. Apple describes them as high-confidence signals.
If I get the notification, is my iPhone infected?
Not for certain. Apple does not confirm whether the device is compromised. The German BSI, however, advises assuming it could be and acting right away.
How do I know if the alert is genuine?
Sign in to account.apple.com and check the banner at the top. A genuine notification never asks you to click links, open files, install apps or enter passwords.
What does Lockdown Mode do?
It provides additional protection against targeted attacks. Apple recommends it to those who received the notification, and also to anyone who suspects they may be a target without having received one.
Who was hit in this wave?
Members of the Bundestag and other German public figures, plus users in 99 countries overall. Among them is the Lebanese filmmaker Radwan Mortada. Who is behind the attacks is not known.
What to watch in the coming weeks in the spyware case
The German investigation and Apple's next moves will show whether technical details emerge. For now, the facts are few.
- Follow updates from the BSI and the German investigation to see whether those responsible are identified.
- Check the security notes for iOS updates to see whether they mention the vulnerability exploited.
- Share with exposed colleagues the support channels available, such as the Access Now Digital Security Helpline.
