Apple Issues iPhone Spyware Warnings in 99 Countries as German Officials Report Attacks Requiring No User Interaction

Apple has issued a new wave of iPhone spyware warnings to targeted users in 99 countries, with German officials confirming that members of parliament and federal government figures were among those alerted. The incident highlights the growing challenge of defending against sophisticated surveillance tools that can access sensitive information without a victim clicking a link or opening an attachment.

Germany's Federal Office for Information Security (BSI) has advised recipients to assume their devices may have been compromised. However, an Apple notification does not establish that an attack succeeded, and neither the company nor German authorities has publicly identified those responsible.

Apple said the latest notifications brought the total number of countries in which it has alerted users to more than 150 since 2021. The company has not attributed the activity to any particular government, attacker, or geographical region.

German Politicians Receive Warnings Over Possible Spyware Targeting

Digital Minister Karsten Wildberger confirmed that members of the Bundestag and the federal government had received Apple's warnings about possible mercenary spyware attacks. The alerts began reaching affected devices on 29 October, according to a letter from the BSI cited by Wildberger. Speaking on German broadcaster ARD's Bericht aus Berlin, he said the agency had responded quickly and contacted those affected with guidance.

The government has not disclosed how many officials received notifications or whether Chancellor Friedrich Merz was among them. It has also not confirmed that any of the devices were successfully infected.

The distinction matters because Apple's alerts indicate that a person may have been individually targeted, rather than proving that spyware was installed. The BSI's precautionary advice reflects the seriousness of the threat, even when investigators cannot confirm a successful compromise.

How Zero-Click Spyware Can Bypass User Interaction

Some mercenary spyware attacks use so-called 'zero-click' exploits. These take advantage of software or device vulnerabilities to deliver malicious code without requiring the owner to click a link, open a file, or take another action.

A report published on 15 October 2026 by the University of Toronto's Citizen Lab demonstrated how targeted online advertising can be abused to deliver spyware. Researchers documented an operation they called 'AdFection', in which malicious advertisements were used to target devices at international broadcaster Al Jazeera.

Citizen Lab linked the operation to Candiru spyware, which has since been rebranded as Integrity Labs. Researchers also identified the Israeli company Discover-Tech as a facilitator of the advertising infrastructure used in the attacks.

The investigation concerned attacks against Al Jazeera devices in 2024 and 2025. It does not establish any connection between that operation and the latest Apple notifications or the warnings received by German officials.

The findings nevertheless illustrate how surveillance operations can exploit infrastructure that people encounter during ordinary internet use. Depending on the spyware and the access obtained, attackers may be able to read messages, access contacts, and location data, monitor calls, or activate a device's microphone and camera.

What iPhone Owners Should Do After an Apple Alert

Apple describes its threat notifications as high-confidence warnings that a person has been individually targeted by mercenary spyware. The company says these attacks are exceptionally sophisticated and generally focus on a small number of people, including journalists, activists, politicians, and diplomats.

A genuine notification can appear on an iPhone's Lock Screen and in Settings. Apple also sends an email to addresses associated with the user's Apple Account and displays an alert when the user signs in at account.apple.com.

Recipients should verify an alert by signing in to their Apple Account directly, rather than following links in an unexpected message. Apple says its threat notifications will never ask users to click a link, install an app or configuration profile, open a file, or disclose a password or verification code.

The company recommends seeking expert assistance, including through Access Now's Digital Security Helpline. Users can also consider enabling Lockdown Mode, an optional setting that restricts certain features and connections to reduce exposure to highly targeted attacks.

Keeping devices updated, enabling two-factor authentication, and using strong, unique passwords are also important security measures. Lockdown Mode is a protective measure, however, not a way to remove spyware or repair a device that has already been compromised.

The latest warnings show why targeted surveillance is difficult to detect: a person does not necessarily need to click on anything suspicious to become a target. For those who receive an alert, taking it seriously is more important than waiting for visible signs of an intrusion.