Apple sent threat notifications to users across 99 countries warning that attackers may have targeted their devices with Apple mercenary spyware, according to reports published by The Financial Times and TechCrunch. German authorities opened an inquiry after lawmakers and federal officials received alerts late last week.
Key points
- Apple dispatched alerts to individuals in 99 countries after detecting suspected commercial surveillance attacks.
- German lawmakers and government personnel received warnings, prompting a national security alert over the weekend.
- The intrusions reportedly used zero-click vulnerabilities that compromised devices using only the target’s phone number.
- Security officials advised affected individuals to assume their hardware was no longer safe and to seek specialist assistance.
German officials targeted in zero-click campaign
Recipients in Germany began receiving Apple’s threat warnings on Thursday, alerting them that state-backed or commercial surveillance tools may have targeted their iPhones. The alerts prompted Germany’s Federal Office for Information Security to issue an urgent advisory over the weekend.
The agency advised affected staff to “assume their device is no longer secure” once an alert arrives. Government officials confirmed they are investigating the scope of the campaign across federal departments.
German government spokesperson Stefan Kornelius declined to confirm whether Chancellor Friedrich Merz received a notification. Kornelius stated that authorities are treating the development seriously while working to determine how many officials were affected.
Technical details reported by The Financial Times indicate the campaign relied on zero-click exploits. These exploits require no interaction from the victim, such as clicking a malicious link or opening an attachment. Attackers needed only the target phone number to deliver the surveillance payload silently over cellular or messaging protocols.
Global reach of the notifications
The warnings extended far beyond European political circles. Apple confirmed in messages sent to victims that the wave of notifications reached users across 99 countries.
Civil society figures and journalists were among those alerted. Radwan Mortada, an investigative documentary director based in Beirut, published his notification publicly on social media. Mortada had previously faced surveillance attempts involving Pegasus spyware in 2017 and 2021.
Mortada stated that he could not identify the entity responsible for the latest targeting, nor whether the intrusion attempt related directly to his reporting work.
More Read
How Apple threat notifications work
Apple periodically issues threat notifications when internal threat intelligence teams detect coordinated activity characteristic of commercial spyware developers. The company has sent similar batches of warnings to individuals in more than 150 countries since launching the detection program in late 2021.
The notifications appear as banners at the top of the Apple Account management page and arrive via email and iMessage to addresses registered with the account. Apple deliberately avoids naming specific actors or governments when issuing the notices.
Attributing commercial spyware to a specific client is difficult because commercial vendors sell surveillance toolkits to multiple intelligence, military and law enforcement bodies worldwide. Disclosing specific detection methods could also help attackers alter their code to bypass internal telemetry.
The company does not state definitively whether an intrusion succeeded on a given handset. Instead, it informs recipients that sophisticated adversaries have targeted their account and hardware, recommending that they take defensive measures immediately.
Protective measures for high-risk users
Recipients of the alerts are advised to engage third-party digital forensics specialists for device inspections. In previous cases, organisations such as the Citizen Lab at the University of Toronto and Amnesty International’s Security Lab have assisted high-risk individuals in analysing system logs for traces of compromise.
Apple also urges targeted users to enable Lockdown Mode. Introduced in iOS 16, the setting places extreme limits on system functions, blocking complex web technologies, message attachments and incoming FaceTime calls from unknown contacts to reduce attack surface against zero-click exploits.
German cybersecurity officials continue to examine devices belonging to parliamentary and federal staff to establish whether any data was extracted during the campaign.
