Germany Warns Lawmakers of State-Backed Spyware Intrusion on iPhones

The German government has issued a stark warning to its lawmakers and prominent public figures, stating that their iPhones may have been compromised by government-backed spyware. This urgent alert comes days after Apple began distributing threat notifications to users it believes are targeted by sophisticated cyberattacks. The Federal Office for Information Security (BSI) confirmed that members of the Bundestag and other unnamed notable individuals received these warnings, highlighting a significant escalation in digital threats against political leadership. According to the BSI, the nature of the threat involves advanced spyware capable of exfiltrating messages, location data, and other sensitive information. The agency emphasized that because Apple does not publicly attribute attacks to specific state actors, any recipient of a threat notification should assume their device has been compromised. German government spokesperson Stefan Kornelius stated that Berlin is taking the incident "very seriously," though he declined to specify which federal officials were targeted, leaving open the question of whether Chancellor Friedrich Merz was among them. The technical sophistication of these attacks is underscored by the use of zero-click exploits. Unlike traditional malware, which requires a user to click a link or open a file, zero-click attacks can compromise devices invisibly and without any user interaction. This capability allows attackers to gain persistent access to high-value targets with minimal risk of detection, posing a severe challenge to standard cybersecurity defenses. The scope of this campaign appears to be global, with Apple reporting that its latest batch of threat notifications was sent to users in 99 countries. The attacks are not limited to politicians; for instance, Radwan Mortada, a Beirut-based filmmaker, reported receiving a new alert indicating another attack on his device, following a previous targeting in 2021. This broad reach suggests a coordinated effort to monitor civil society and political figures across multiple jurisdictions. The episode underscores the murky and lucrative market for "mercenary spyware." Governments rarely develop these tools in-house but instead purchase them from private vendors, such as Israel’s NSO Group, which sells the controversial Pegasus spyware. Notably, Germany’s own Federal Criminal Police Office (BKA) reportedly purchased access to Pegasus in 2019, illustrating the complex and often contradictory relationship between states and the private sector in the realm of digital surveillance.