Apple Spyware Alerts Reach the Bundestag and Merz's Asia Delegation: Germany's BSI Tells Recipients to Assume Their iPhones Are Infected and Replace Them
Apple's latest mercenary spyware warnings, sent to users in 99 countries, reached German lawmakers, ministry staff and journalists linked to Chancellor Merz's Asia trip, and the BSI has told recipients to replace their devices.
Germany's federal cybersecurity agency has told members of the Bundestag, government staff and other public figures who received Apple's mercenary spyware warnings to assume their iPhones are compromised and replace them immediately. The alerts, which began arriving on 29 October 2026, reached people around Chancellor Friedrich Merz's recent Asia trip. Apple says this round of warnings went to users in 99 countries.
No one has publicly named the spyware or the government behind it. The federal agency, the BSI, says it does not yet know how many devices were actually infected, as opposed to targeted, or why these people were chosen.
What Happened
The Federal Office for Information Security (BSI) confirmed that several members of the Bundestag and other public figures had received an Apple threat notification since 29 October. Within 24 hours of Apple's alerts, the BSI sent the recipients a letter warning them to treat their devices as infected and to replace them.
The people notified reportedly include members of the German delegation that travelled with Chancellor Merz to South Korea, Japan and Singapore: federal ministry staff, lawmakers and journalists. On 3 November, Franziska Brantner, co-leader of the Green Party and a member of the Bundestag's European Affairs Committee, said publicly that she was one of them. Most recipients have not come forward.
Digital Minister Karsten Wildberger discussed the cases on public television on 1 November and said the government had "reacted super quickly".
How Apple's Threat Notifications Work
Apple sends these alerts when it believes a user has been individually targeted by "mercenary spyware", the expensive commercial surveillance tools that are usually sold to governments. Notifications appear as a banner at the top of the Apple Account page and are followed by an email and an iMessage to the addresses and number linked to the account.
Some things to keep in mind:
- A notification means targeting, not proven infection. Apple does not say whether an attack succeeded, and it never names the attacker.
- Apple never asks you to click links, install apps or share codes in these alerts. Fake "Apple threat notification" messages are a known phishing lure. Check for a genuine alert by signing in at
account.apple.comdirectly. - Apple has sent these notifications in many rounds since 2021, and they often lead to forensic confirmation of spyware afterwards.
Who Is Affected
- German lawmakers, officials and journalists, especially those connected to foreign policy and the Chancellor's Asia trip.
- Recipients in 98 other countries. Before the German cases, a Lebanese documentary filmmaker and a Turkey-based reporter were among the first to say publicly that they had been warned.
- Their contacts. A compromised phone exposes not just its owner but every chat, call and document shared with them, including encrypted messaging apps, which spyware reads on the device itself.
There is currently no public evidence that ties this wave to any specific spyware product, vendor or government. Claims linking it to Pegasus or to earlier cases elsewhere in Europe have not been substantiated.
Why the Replacement Advice Is Notable
The BSI's advice goes further than the usual "update and enable Lockdown Mode". Modern mercenary spyware often runs only in memory and leaves few traces. Forensic tools can confirm an infection, but they cannot always prove a device is clean. For officials who handle sensitive government information, replacing the phone is the most reliable way to remove any doubt. Investigators can then examine the old device offline.
What To Do Now
If you receive an Apple threat notification:
- Confirm it is genuine by signing in to your Apple Account directly. Do not follow links in the message.
- Update immediately to the latest iOS, iPadOS or macOS version.
- Turn on Lockdown Mode (Settings, Privacy & Security, Lockdown Mode). It sharply reduces the attack surface that spyware relies on, including attachments, link previews and some web technologies.
- Get expert help. Apple points users to Access Now's Digital Security Helpline. Officials should contact their organisation's security team or, in Germany, the BSI.
- Preserve the device for forensics if you can, rather than wiping it. Mobile forensic tools such as the open-source Mobile Verification Toolkit can look for known spyware traces in a backup:
# Defensive check of an iPhone backup with the open-source Mobile Verification Toolkit
pip install mvt
mvt-ios check-backup --iocs ./indicators.stix2 --output ./mvt-results /path/to/backup- Tell your contacts who handle sensitive material, and move sensitive conversations to a clean device.
High-risk users who have not been warned should still turn on Lockdown Mode, restart their phone regularly (which can clear some memory-only implants) and keep automatic updates on.
Why It Matters
This is one of the clearest signs yet that commercial spyware is being aimed at the core of a major EU government, at people travelling with its head of government. It comes days before the Pall Mall Process meeting in Paris on 11–12 November, where governments and industry are expected to present voluntary guidelines on commercial spyware. Researchers and MEPs say Germany's cases show those guidelines are overdue. One researcher who tracks mercenary spyware described Europe as having "an untreated mercenary spyware epidemic". Until there is accountability for the vendors and their customers, the burden falls on targets: update quickly, use Lockdown Mode and take Apple's warnings seriously.
