Apple’s spyware alert hit 99 countries, and Germany says treat the iPhone as hacked

Apple has sent a fresh round of its rarest and most serious iPhone warning, the Apple Threat Notification, to people in nearly a hundred countries. It lands on the Lock Screen and in Settings with a blunt line: Apple detected a mercenary spyware attack targeted at your iPhone. Germany’s federal cybersecurity agency has now gone further than Apple usually does, telling recipients to treat their phones as possibly compromised.

For most people, the practical news is reassurance plus a checklist. Apple says the vast majority of users will never face this class of attack, which costs millions to build and is aimed at a handful of people because of who they are or what they do. Anyone whose work puts them close to power, money or a newsroom now has a clear playbook from a national security agency for the moment that red warning triangle appears.

Apple’s notice, shared publicly by recipients, says this batch went to targeted users in 99 countries. Germany’s Federal Office for Information Security, the BSI, said several members of the Bundestag and other public figures received it, and digital minister Karsten Wildberger confirmed on German public television that members of the federal government were also warned. Government spokesperson Stefan Kornelius told the Financial Times that Berlin is “taking the incident and the warning very seriously,” without saying who was targeted.

Journalists went public too. Ragıp Soylu, Turkey bureau chief for Middle East Eye, posted his alert on X and said it was his third this year. Radwan Mortada, a Beirut-based investigative journalist and documentary filmmaker who says NSO Group’s Pegasus spyware targeted him twice before, shared a notice in which Apple said it had detected “another attack against your device.”

The reason for the alarm is what this software does once it is in. According to the BSI, mercenary spyware can read messages, including those in encrypted apps, and reach calls, contacts, calendars and location. It can also switch on the camera and microphone. In known cases it arrives through zero-click exploits that need no tap from the victim, and the Financial Times reported that the attackers in this round needed little more than a target’s phone number.

The BSI’s advice is unusually concrete. Update the iPhone immediately, unless you plan to have it forensically examined first. Turn on Lockdown Mode and keep it on, even on a replacement phone. If the risk looks high, get a new device, reset every account used on the old one and change the phone number, then set a new passcode, new passwords for the Apple Account and email, and two-factor authentication. The agency also recommends Signal’s registration lock and WhatsApp’s two-step verification with fresh PINs, and removing any linked devices you don’t recognize.

None of this tells recipients what actually happened. Apple does not name attackers or say whether an attack succeeded, and the BSI says it does not know whether the warnings reflect real compromises or only attempts. Security researcher Costin Raiu told The Record that he had checked several victims’ notifications and found no signs of compromise in the logs that could identify who was responsible. Lockdown Mode also has a price: it blocks most message attachments, link previews and FaceTime calls from unknown people, which some users will find too limiting to keep. And the alert itself is a lure scammers can copy. Apple says a genuine notification never asks you to click links, open files, install apps or profiles, or share a password or code. The safe check is to sign in at account.apple.com, where a real warning appears as a banner at the top of the page.

The help on offer depends on where you live. The BSI’s reporting channel is for people in Germany. Elsewhere, Apple points recipients to the Digital Security Helpline at the nonprofit Access Now, which answers around the clock, and reminds everyone else that standard hygiene still matters: current software, a strong passcode, two-factor authentication and passkeys where available.

The notifications began reaching iPhones on October 29, and the BSI wrote to Bundestag members the next day. Raiu flagged the wave on October 30 and said it was separate from Apple’s August round and tied to new attacks. Apple has sent these warnings several times a year since 2021 and says it has now notified users in more than 150 countries. Apple has not commented on the German cases. The BSI is collecting reports from recipients to measure how many German devices were hit, and neither the agency nor Apple has said whether more detail will follow.

Tags: Apple, Cybersecurity, iPhone, spyware, Apple Threat Notification, BSI