Apple has sent a new round of warnings to people it believes were targeted with commercial spyware, reaching users in 99 countries, The Record reported Monday, and Germany's federal cybersecurity agency said members of the Bundestag, the national parliament, were among the recipients. For executives and officials who carry iPhones, the episode shows such an alert should be treated as a sign the device may already be compromised.
What Happened
Since Oct. 29, several Bundestag members and other public figures have received Apple threat notifications saying the company detected an attack using "mercenary spyware," the Federal Office for Information Security (BSI) said in an advisory. The agency describes such tools as commercially built surveillance software often used on behalf of governments against carefully chosen people, with NSO Group's Pegasus the best-known example. German tech outlet heise online reported that members of the federal government were also warned.
The BSI wrote to Bundestag members Oct. 30 and asked anyone affected to contact it. It said it does not know whether the alerts reflect infected devices or only attempted attacks. This kind of spyware typically arrives by "zero-click" methods, such as a message that never has to be opened, and victims usually notice nothing.
The 99-country figure first appeared in a screenshot of the notice posted by threat researcher Costin Raiu, who said he had verified several recipients' alerts, according to The Record. Apple did not respond to The Record, but heise reported that Apple confirmed the figure to it. Apple's notices say it does not attribute attacks to specific actors or regions, and Raiu told The Record that logs so far showed nothing identifying who was responsible.
Why It Matters
Apple told heise that such attacks reach only a small number of people. A compromised phone can expose messages, including in encrypted apps, along with calls, contacts, location, camera and microphone, the BSI said. That this round reached sitting lawmakers in a major European Union and NATO member shows senior decision-makers remain targets.
For U.S. executives and officials, especially those who travel, the BSI's advice works as a checklist: update the operating system immediately unless a forensic examination is planned; turn on Lockdown Mode, an Apple setting that limits some features to make attacks harder but does not remove an existing infection; and in high-risk cases replace the device, reset its accounts and change the phone number. It also recommends new passcodes and passwords, two-factor authentication, Signal's registration lock, WhatsApp's two-step verification and a review of linked devices.
What to Watch
Open questions are how many people were warned, whether any phones were infected and who is behind the campaign. John Scott-Railton, a researcher at Citizen Lab, told The Record that Apple made its alerts more visible in August and that targets coming forward suggest the change is working. The commercial spyware industry is also drawing investor interest: The Primary Wire reported in September, citing The Record, that Graphite maker Paragon plans to go public.
