Germany’s federal cyber security agency, the BSI, says several Bundestag members and other public figures have received Apple threat notifications since October 29. The alerts say Apple detected a mercenary spyware attack. The BSI advises anyone who got one to assume, as a precaution, that their iPhone may have been compromised.
Digital minister Karsten Wildberger confirmed the warnings on ARD’s Bericht aus Berlin on Sunday, Euronews reports. He said members of the Bundestag and the federal government had received them. He did not say how many people were alerted or who they were.
These are the same Apple spyware alerts any iPhone owner can receive. That makes the BSI’s advice useful well beyond Berlin.
What we know about the alerts so far
The BSI says it doesn’t know whether the notifications mean actual compromises or only attempted attacks. Apple’s alerts don’t say whether an attack succeeded. Apple also doesn’t attribute these attacks to any government. Neither Apple nor German authorities have said who is behind this one.
On October 30, the BSI wrote to Bundestag members about the danger and the steps they should take. It asked anyone affected to contact the agency directly.
The German alerts may be part of a wider batch. Beirut-based filmmaker Radwan Mortada posted on X that he had received a new notification. He said this batch went to users in 99 countries, TechCrunch reports. Apple sent out a similar wave of spyware alerts in August.
Government spokesperson Stefan Kornelius said Berlin was taking the incident and the warning seriously, according to the Financial Times, via TechCrunch. He did not say who was targeted, including whether Chancellor Friedrich Merz was.
Mercenary spyware can infect a phone without the victim doing anything. The BSI says a compromised device can expose messages, including those in encrypted messengers. Attackers can also reach calls and contacts. Location, camera and microphone are at risk too.
How to tell a real Apple threat alert from a fake
Scammers imitate these warnings, so check before you act. According to the BSI, a genuine Apple threat notification shows up in several places:
- On your iPhone’s lock screen and in Settings
- By email, at the addresses linked to your Apple Account
- At the top of account.apple.com after you sign in
Apple never asks you to click links or open files. It also never asks you to install apps or profiles, or to hand over passwords or codes. If you’re unsure, type account.apple.com into your browser yourself.
What the BSI says to do if you get one
The BSI’s checklist was written for politicians, but it works for anyone who receives a real alert:
- Update iOS straight away, unless you plan to have the phone forensically examined first.
- Turn on Lockdown Mode. Go to Settings > Privacy & Security > Lockdown Mode > Turn On Lockdown Mode > Turn On & Restart. Keep it on permanently, including on any new phone.
- Consider replacing the phone if the risk is high. That means resetting every account used on it and changing your phone number.
- Secure your accounts. Set a new device passcode and change your Apple Account, email and other passwords. Turn on two-factor authentication.
- Set up authenticator apps from scratch instead of transferring them.
- Protect your messengers. Turn on Signal’s Registration Lock and WhatsApp’s two-step verification with new PINs.
- Check linked devices in Signal, WhatsApp and your Apple Account, and remove any you don’t recognise.
Lockdown Mode makes new attacks harder, but the BSI notes it won’t remove an infection that’s already there. It restricts message attachments and link previews. It also blocks FaceTime calls from unknown people. Normal phone calls and plain text messages keep working.
For more on recent iPhone threats, see our coverage of P7 DarkSword, which targets Keychain and crypto wallets.
Sources: BSI, Apple Support, Euronews, TechCrunch
