Germany says anyone who got Apple’s latest spyware alert should assume their iPhone may be compromised

Germany’s federal cybersecurity office, the BSI, told people who received Apple’s latest spyware warning to assume their iPhone may have been compromised. Members of the Bundestag and other unnamed public figures received the notifications, which Apple said went out to users in 99 countries. The BSI cannot say whether the alerts reflect successful hacks or only attempted ones.

Tech news in one quick read: Get the most interesting stories in startups, tech and programming, each with a short TLDR, in one daily email from TLDR.

Subscribe to TLDR →

We may earn a commission if you sign up.

Affected people have been getting the notifications since Oct. 29, and the agency wrote to Bundestag members the next day. Government spokesperson Stefan Kornelius said Berlin was taking the incident and the warning very seriously, according to the Financial Times, but he did not say who in the federal government was targeted, including whether Chancellor Friedrich Merz was among them.

The BSI’s public note, reported by TechCrunch on Nov. 2, treats the warning as serious enough to change behavior. Anyone who received an Apple threat notification should therefore assume the device may have been compromised, the agency said, even though Apple itself does not confirm that a phone was actually breached.

The BSI checklist: update, Lockdown Mode, replace the phone

The agency’s guidance page on mercenary spyware sets out six steps. The first is to update the operating system immediately, unless a forensic analysis is planned. The second is to consider Lockdown Mode, which makes future attacks harder, though it does not remove an existing infection and limits features such as message attachments, link previews and FaceTime calls from unknown contacts.

Anyone who rates the risk of compromise as high is advised to consider replacing the device and resetting every account used on it, possibly including the phone number. After that come a new passcode that differs from the old one, new passwords for the Apple Account and email, two-factor authentication everywhere, a fresh trusted phone number, authenticator apps set up again rather than transferred, and Registration Lock in Signal or two-step verification in WhatsApp with a new PIN. The BSI also asks recipients to report the notification to the agency so it can gauge the scope.

The BSI is explicit about why it takes the alerts seriously. A compromised phone can expose messages, including those in encrypted messengers, along with calls, contacts, the calendar, location, camera and microphone. Attacks can be zero-click, so the owner usually notices nothing. The agency says people should also treat unusual behavior as a warning sign if it differs from previous months, for example frequent crashes or unusually fast battery drain.

What Apple says its alerts mean

Apple’s support page on threat notifications calls them high-confidence alerts that warn a user may have been individually targeted by mercenary spyware, which it describes as highly sophisticated and costly. Apple has sent them since 2021, several times a year, to users in more than 150 countries. It does not say what triggers one and does not attribute attacks to particular governments or vendors.

A TechCrunch report from August covered a batch sent to users in 110 countries. John Scott-Railton, a senior researcher at Citizen Lab, called the newer alert format a big improvement over Apple’s 2021 versions and said the notifications create a critical signal that a community is being targeted. Apple has said it has not seen a device hacked while Lockdown Mode was enabled.

Apple’s own recommended steps are shorter than the BSI’s. It points recipients to Lockdown Mode and to expert help such as Access Now’s Digital Security Helpline, which operates around the clock, and gives general advice for everyone: keep software updated, use a passcode or biometrics, enable two-factor authentication, rely on strong unique passwords or passkeys, and avoid links or attachments from unknown senders.

An unknown operator and a long history of mercenary vendors

Nobody has said who is behind this round. Mercenary spyware is typically sold by private vendors to governments, and the best known is NSO Group’s Pegasus. Zero-click variants infect a phone without any tap, which is why victims usually notice nothing. A Citizen Lab report covered on Oct. 15 found government spyware makers delivering zero-click attacks through online ads, and senior researcher Bill Marczak called the vendor it exposed surely just the tip of the iceberg.

Germany has its own history with the trade. TechCrunch notes that the country’s Federal Criminal Police Office was reported to have bought access to Pegasus in 2019, which makes a German government response to commercial spyware a more layered matter than a simple victim statement. The BSI’s wording is careful on that point: it speaks of attacks typically used by state actors against selected individuals, and it names no country.

Beirut-based filmmaker Radwan Mortada said on X that he received a new notification from Apple about another attack on his device; he had been targeted by spyware in 2021. The BSI says a genuine notification appears on the lock screen and in iPhone settings, is also emailed to the Apple Account address, and shows at the top of the account page after sign-in. Apple never asks recipients to click links or share codes. Whether Merz or any minister received an alert remains unanswered.

This article was produced with the assistance of AI and reviewed by Morning Overview editors prior to publication.

Tech news in one quick read: Subscribe to TLDR →

We may earn a commission if you sign up.