Apple has sent a new wave of threat notifications telling iPhone owners in 99 countries that they may have been targeted by mercenary spyware. This time the recipients include members of Germany’s Bundestag and government officials. According to press reports, the attack used a zero-click vulnerability that required only the target’s phone number. Such warnings rarely reach ordinary users. If one does appear, first confirm it through account.apple.com rather than through any link in the message. Then turn on Lockdown Mode, as Apple advises.
What you need to know
- Apple began sending the latest notifications in late October. The notification text says this wave reached users in 99 countries.
- German lawmakers and officials started receiving the alerts on Thursday, October 29. Germany’s main cybersecurity agency then warned that affected phones may have been compromised.
- Journalists report that the attack was zero-click. The target did not have to tap a link, open a file or answer a call.
- A genuine Apple warning never asks you to click links, install apps or profiles, or share your Apple Account password or verification code.
An iPhone on a desk next to a Mac mini and AirPods, with an Apple notification about a targeted spyware attack on the lock screen
Nearly 100 countries, no names
Apple started sending the new batch of warnings at the end of October, and the Western press began reporting on it on November 2. The notification itself states that this wave went to users in 99 countries. That is not a record. In August, people in 110 countries received warnings, and over the lifetime of the system Apple has sent them to users in more than 150 countries.
It is not known who is behind the attacks, and Apple is unlikely to say. The company does not name the parties behind such attacks or the countries they came from. It does not even say whether a specific phone was actually compromised. It states only that, in its assessment, the person has been targeted by mercenary spyware. Apple uses this term for commercial surveillance tools that private companies sell to governments.
Close-up of an iPhone lock screen showing an Apple security notification that the company has detected a targeted spyware attack
How Apple delivers these warnings
Apple has sent these notifications since 2021, usually several times a year. Each warning arrives through three channels at once:
- on the iPhone lock screen and in Settings;
- by email from Apple Account;
- as a banner on account.apple.com.
Apple’s support documentation describes them as high-confidence alerts. The company does not disclose what triggers a notification, so that spyware developers cannot learn how to evade its detection. Based on the pattern of recent years, the original report expects another wave in roughly two to three months. That is an estimate, not an announcement from Apple.
Germany raises the alarm at government level
The new wave drew the most attention in Germany. On Thursday, October 29, members of the Bundestag and government officials began receiving the notifications. Over the weekend, the country’s main cybersecurity agency issued an urgent warning. It said anyone who received the Apple message should assume that their phone may have been compromised. Germany’s digital minister confirmed that individual devices may have been infected but said the origin of the attack was still unclear.
The government said it was taking the incident very seriously and had opened an investigation. It declined to say whether Chancellor Friedrich Merz was among the targets. It also has not disclosed how many politicians received a warning.
A zero-click attack
A more troubling detail emerged later. According to journalists, the attack exploited a zero-click vulnerability. The iPhone owner did not need to do anything: no link to tap, no file to open, no call to answer. Knowing the phone number was enough. As the original report notes, a lawmaker’s phone number is far easier to obtain than persuading that lawmaker to tap a suspicious link. The author calls this the most alarming part of the story.
The case also carries some irony. According to reporting by American journalists, Germany’s federal police bought access to Pegasus back in 2019.
Why mercenary spyware is not used on random people
If you are not a politician, diplomat or investigative journalist, your chances of seeing this kind of notification are very small. Ordinary iPhone owners face different threats. These are mass-scale and far more mundane schemes, such as attacks through Safari and ads aimed at stealing cryptocurrency. Those can hit anyone.
Mercenary spyware works differently. Private companies develop it and sell it to governments. The best-known example is Pegasus, developed in Israel. Such software can extract messages, location data and other personal information from a phone. Exploit chains for zero-click attacks are expensive, and they stop working once Apple releases a patch. For that reason, they are reserved for specific targets. Apple says in its documentation that people are targeted because of who they are and what they do.
An iPhone on a stand showing a full-screen Apple warning about a mercenary spyware attack, with a laptop and a hacker silhouette in the background
The case of a filmmaker from Beirut illustrates this. He also received one of the new notifications, in which Apple refers to “another attack” on his device. He described it on social media and noted that Pegasus had already tried to get into his phone in 2017 and 2021. He says he does not know who is behind the latest attempt or whether it is connected to his documentary film.
A genuine Apple warning asks nothing of you
The first line of defense against any attack is unglamorous but effective: keep your iPhone’s software up to date. The original report specifically recommends installing iOS 27.2, even on an iPhone that is working fine. It argues that the new wave of warnings is one more reason to do so.
Scammers often exploit high-profile surveillance news, so one rule is worth remembering. In these notifications, Apple never asks you to tap links, open files, or install apps or profiles. Apple also does not ask for your Apple Account password or verification code, whether by email or by phone. If a message claiming to be from Apple asks for any of these things, it is fake.
How to check whether a warning is real
Verifying a notification takes about a minute:
- Do not tap anything in the email or message itself.
- Open a browser and type account.apple.com yourself.
- Sign in to your Apple Account.
- Look at the top of the page. If Apple really sent a warning, a prominent banner will appear there.
If the warning is genuine: turn on Lockdown Mode
If the banner is there, Apple advises turning on Lockdown Mode right away. You will find it under Settings > Privacy & Security > Lockdown Mode. After a restart, the iPhone will:
- block most attachment types in Messages other than images;
- disable some web technologies in Safari;
- reject FaceTime calls from unknown contacts.
The phone becomes less convenient to use; for example, links arrive without previews. The mode has nonetheless proven its value. In 2023, researchers confirmed that it blocked an attack being used to install Pegasus on iPhones.
Three screenshots of iPhone Settings: the Privacy & Security section, the Lockdown Mode option and the Turn On Lockdown Mode button
Get expert help
Apple’s second recommendation is not to deal with the situation alone. Its support page lists contact details for a 24/7 digital security helpline run by a human rights organization. The helpline specifically assists people who have received this kind of warning. Beyond that, basic security hygiene still applies: two-factor authentication, a strong passcode and Stolen Device Protection turned on.
The bottom line
For most readers, this will remain a story about Germany. But if a lock-screen alert ever mentions “mercenary spyware,” do not swipe it away with your other notifications. Do not go looking for answers in your email either. Open account.apple.com in your browser and check for yourself.
