Apple Spyware Alerts Target German Bundestag Lawmakers
BSI advises officials to assume device compromise following advanced mercenary spyware notifications.
1Targeted Bundestag Notifications
Since October 29, 2026, members of the German Bundestag and federal government officials received threat notifications from Apple. These alerts indicate potential targeting by advanced mercenary spyware. Digital minister Karsten Wildberger confirmed the warnings, noting that the BSI is coordinating with affected individuals to manage the security incident effectively.
2Nature of Mercenary Spyware
Mercenary spyware represents highly sophisticated, commercially developed surveillance tools often utilized by state actors. Unlike common cybercrime software, these tools frequently employ zero-click exploits, allowing infection without user interaction. Once deployed, attackers gain full access to encrypted messages, calls, location data, and can remotely activate device cameras and microphones.
3BSI Risk Assessment
The Federal Office for Information Security, known as the BSI, remains uncertain if these notifications confirm successful compromises or merely attempted attacks. Despite this ambiguity, the agency advises all recipients to operate under the assumption that their devices are compromised. This precautionary stance aims to mitigate potential data exfiltration risks.
4Immediate Mitigation Steps
The BSI recommends that affected users immediately update their device operating systems. Unless forensic analysis is planned, users should enable Lockdown Mode. This feature restricts specific functionalities like link previews and FaceTime calls from unknown contacts, thereby reducing the attack surface for potential exploits while maintaining essential communication capabilities.
5Device Replacement Protocol
For high-risk individuals, the BSI suggests replacing the compromised device entirely. This process requires resetting all associated accounts and changing phone numbers to prevent repeat targeting. Users must establish new passcodes, update passwords for Apple and email accounts, and ensure robust two-factor authentication is active across all sensitive digital services.
6Securing Communication Apps
Beyond system-level changes, the BSI mandates securing messaging applications. Users should enable registration locks on Signal and two-step verification on WhatsApp, utilizing unique PINs for each service. Additionally, individuals must audit their accounts to remove any unrecognized linked devices, ensuring that attackers cannot maintain persistent access through secondary hardware or sessions.
7Global Scope of Attacks
These warnings were not isolated to Germany; Apple issued similar notifications to users across 99 countries. Filmmaker Radwan Mortada reported receiving a warning on October 30, 2026, highlighting the global reach of these campaigns. Despite the widespread nature of the alerts, the specific state actors behind these operations remain publicly unidentified.
8Verification and Reporting
The BSI urges affected individuals to contact their service center directly at [email protected] for guidance. The agency emphasizes that legitimate Apple notifications never request passwords, file installations, or link clicks. Official warnings appear exclusively on the lock screen, within settings, or inside the secure account.apple.com portal after signing in.
Original article: Security Affairs — Apple Spyware Alerts Target German Bundestag Lawmakers