Apple has sent another round of its threat notifications, the alerts it sends when it believes someone has been individually targeted by mercenary spyware. In a statement reported by CyberScoop, the company said this batch went to targeted users in 99 countries, and that it has now notified users in over 150 countries in total since the program started. This time some of the recipients are in Berlin's political class.

German Digital Minister Karsten Wildberger confirmed on the public broadcaster ARD that members of the Bundestag and the federal government received the warnings, Euronews reported. Germany's Federal Office for Information Security (BSI) then told recipients to assume their devices may be compromised. According to The Record, the letter said to assume the device is infected and replace it immediately.

Nobody has said who is behind the campaign. Apple does not attribute these attacks, and Euronews reports that neither Apple nor German authorities have said who may be behind it. None of the reporting we reviewed identifies the vulnerability used to reach the phones. So this is not a confirmed, named zero-day. It is a targeted-spyware story. We file it under zero-days because commercial spyware of this kind typically gets onto phones through vulnerabilities the vendor does not yet know about, but that is background, not something these sources establish for this campaign.

Who got the warnings

According to The Record, citing Der Spiegel, the notifications went to members of a German delegation of federal ministry staffers, lawmakers and journalists traveling with Chancellor Friedrich Merz on a trip through Asia. Franziska Brantner, co-leader of the Green Party, said publicly that she was one of the recipients. Hannah Neumann, a German member of the European Parliament, told The Record that several foreign policy politicians and staffers received notifications in this round, which she described as "very different this time" from earlier rounds.

Germany was not where the story first broke. The Record notes that a Lebanese documentary filmmaker and a Turkey-based reporter were the first victims to publicly confirm they had received warnings. Apple's own support page says mercenary spyware is deployed against a very small number of people, often journalists, activists, politicians and diplomats.

The timeline is still coming together. A BSI letter seen by Wildberger and cited by Euronews says the alerts began reaching phones on October 29. The Record reports that the BSI sent recipients its warning letter on Friday. CyberScoop, in a story dated October 30, says Apple's previous major batch of notifications went out in August.

What a threat notification actually means

Apple's support page on threat notifications, published August 13, 2026, describes the alerts as informing users who may have been individually targeted by mercenary spyware, likely because of who they are or what they do. Apple calls them high-confidence alerts, while noting that its investigations can never achieve absolute certainty. The page says these attacks cost millions of dollars and have historically been associated with state actors, including private companies developing mercenary spyware on their behalf, such as NSO Group's Pegasus. Apple says it has sent these notifications multiple times a year since 2021. The page itself does not include the new 99-country figure. That number comes from Apple's statement to CyberScoop.

A notification does not prove an infection. Euronews reports that the alerts do not show whether an attack succeeded, and The Record reports that the BSI does not know how many recipients' devices were actually infected and how many were only targeted. That is why its advice is to assume the worst. When the potential victims sit in a national parliament, replacing a phone is cheap compared with being wrong.

The reverse is a separate caution. CyberScoop reports that Citizen Lab's John Scott-Railton cautioned that the lack of a notification does not rule out an infection. Access Now's Natalia Krapiva also commented on the new wave, saying repressive states continue to use these surveillance technologies against civil society actors and opposition figures.

What this class of spyware can do

The BSI's description of the risk, as reported by Euronews, is a good reminder of why governments worry about these tools. According to the BSI, spyware of this kind can give attackers access to messages, including those sent on encrypted apps, as well as to calls, contacts, calendars and location data. It can also switch on a phone's microphone and camera.

The point about encrypted apps is often misunderstood. Spyware like this generally does not break the encryption. It sits on the endpoint and reads messages before they are encrypted or after they are decrypted. Encrypted messaging protects data in transit. It does nothing once the phone itself belongs to someone else.

The policy backdrop

CyberScoop points out the timing. The notifications came shortly before the final rounds of negotiations over industry standards for commercial hacking tools under the voluntary Pall Mall Process. The Record adds that a Citizen Lab researcher noted the attacks became public on the eve of a Pall Mall Process meeting in Paris on November 11-12, where voluntary industry guidelines for spyware usage are to be unveiled. Scott-Railton told The Record it would not shock him if companies giving feedback at Pall Mall were among those captured by Apple's latest round. That is his speculation, not a finding, and none of the sources show a link between the notifications and the talks. But the overlap is hard to ignore: a very public case of politicians and journalists being targeted lands just as governments and industry finalize voluntary guidelines for the companies that sell these capabilities.

What It Means for Defenders

Most organizations will never see one of these alerts. For the people likely to get one, and for the IT and security teams supporting them, the sources give clear guidance.

Who is affected. The people Apple believes were individually targeted, in 99 countries this round. Reported German recipients include Bundestag members, federal government members, foreign-policy staff, and journalists who traveled with the chancellor. If your organization supports executives, legislators, policy staff, journalists or advocacy groups, especially people who travel abroad for diplomatic or high-profile work, treat this as relevant to you.

Verify the notification through the right channel. Apple says it delivers threat notifications in three ways. An alert appears on the iPhone's Lock Screen and in Settings. Apple sends an email from [email protected] to addresses associated with the user's Apple Account. And a banner is displayed at the top of the user's Apple Account page after they sign in at account.apple.com. Apple says the notifications never ask users to click any links, open files, install apps or profiles, or provide an Apple Account password or verification code. A message claiming to be an Apple spyware alert that asks for any of these should be treated as suspicious and reported to your security team. To confirm a notification is genuine, sign in to account.apple.com directly rather than clicking anything in a message.

If the alert is real, follow the BSI's lead. The German agency's guidance is to assume the device is compromised and replace it. For managed fleets, that means:

  • Pull the device from service and keep it for forensic review instead of wiping it right away.
  • Issue the user a clean replacement.
  • Rotate credentials and sessions that were reachable from the old phone. Include work email, messaging, VPN and SSO accounts, and anything that used the phone as an MFA factor.
  • Assume that messages, contacts, calendar entries, location history and anything said near the phone may have been exposed. Brief the user, and anyone who exchanged sensitive information with them, on that basis.

Turn on Lockdown Mode for high-risk users. Apple's recommended step for notified users is to enable Lockdown Mode, and it says people who have not been notified but have good reason to believe they may be individually targeted can enable it too. Citizen Lab's Scott-Railton seconded the recommendation. For a lawmaker, a senior policy aide or a journalist on a sensitive assignment, consider turning it on before travel, not after a notification arrives.

Get expert help. Apple strongly suggests notified users enlist expert help, such as the Digital Security Helpline at the nonprofit Access Now, which is available 24 hours a day, seven days a week. Organizations without in-house mobile forensics should line up that kind of help ahead of time.

Do not treat silence as safety. As Citizen Lab's Scott-Railton cautioned, the absence of a notification does not rule out infection. If someone in your organization traveled with notified people, works on the same files, or fits the same profile, apply the same protections even if their own phone stayed quiet.

What we don't know yet. No patched iOS version, CVE or exploited vulnerability has been tied to this wave in the reporting we reviewed, and no attacker has been named by Apple or the German government. Keep devices fully updated as a baseline, as Apple advises, and watch for Apple security advisories that may follow. Do not assume a specific fix exists for this campaign until Apple says so.

Sources