Lawmakers in Germany who got Apple’s spyware warning are being told by the state cyber agency to treat their iPhones as possibly hacked. The advice is blunt: update iOS at once, and consider switching on Lockdown Mode.
The agency, known as the BSI, says several Bundestag members and other public figures have received the notification since 29 October. Apple’s message says it detected an attack with so-called mercenary spyware, a commercial surveillance tool usually sold to governments and aimed at a few chosen people.
The BSI says it does not know whether the alerts mean real infections or only attempted attacks. Apple does not say either, so the agency’s guidance page tells recipients to act as if the worst happened. It wrote to Bundestag members on 30 October and asked affected people to contact it directly.
What the BSI tells recipients to do
Software of this kind can infect a phone without any tap, for example through a crafted message that never has to be opened. Once inside, it can read messages in encrypted apps, calls, contacts, calendar entries and location, and switch on the camera and microphone. The BSI says victims usually notice nothing.
Its checklist is practical. Update the operating system first, unless a forensic analysis is planned. Then turn on Lockdown Mode (Settings, Privacy & Security, Lockdown Mode), which blocks message attachments, link previews and FaceTime calls from strangers. It will not remove an infection that is already there, the agency adds.
People who think the risk is high should consider replacing the phone, resetting every account used on it and changing the phone number. The BSI also lists a new device passcode, new passwords for the Apple Account and email, two-factor authentication, and a registration lock on Signal and two-step verification on WhatsApp with new PINs. Linked devices on those apps should be checked and unknown ones removed.
A genuine Apple alert appears on the lock screen and in iPhone settings, arrives by email, and shows at the top of account.apple.com after sign-in. Apple never asks recipients to click links, open files, install apps or profiles, or share passwords and codes, the BSI notes. Anyone unsure should open account.apple.com in a browser instead of following a link.
A wider round of alerts
The German warning follows the new batch of Apple threat alerts sent to users in 99 countries. Government spokesperson Stefan Kornelius called the warning a serious matter, according to TechCrunch’s report, but he left open which officials were hit and whether Chancellor Friedrich Merz is one of them. Outside Germany, Beirut filmmaker Radwan Mortada posted that his new alert follows a spyware attack on him in 2021.
Nobody has said who is behind the latest attacks or which government ordered them. Such tools are normally built by private vendors, and the best known is NSO Group’s Pegasus.
The BSI is collecting reports at its service centre, and it asked recipients to write in so it can judge the scale.
