Germany's federal cybersecurity agency has advised members of the Bundestag and members of the federal government to assume their iPhones may be compromised, after Apple began sending targeted threat notifications to German politicians.
The BSI (Bundesamt für Sicherheit in der Informationstechnik) wrote to those affected following the Apple alert, as first reported by ARD's Berlin studio and confirmed by Digital Minister Karsten Wildberger. In ARD's "Bericht aus Berlin" he described "a notification from Apple that certain devices may possibly have been compromised with so-called spyware." The BSI, he said, reacted "super fast" and wrote to everyone affected with instructions on what to do.
The alerts began arriving on 29 October, according to the BSI letter. Apple classifies this as a warning about mercenary spyware: commercially built intrusion software sold to governments and used against a deliberately small number of people — typically journalists, activists, lawyers and politicians. Apple says it sends such notifications when it has high confidence that a specific user has been individually targeted, and describes them as strong indicators of a targeted attack, while stressing that they are not proof that a device is infected.
The BSI says it has no further information about the background of the alerts, and has advised recipients to proceed on the assumption that their phones may be compromised. Whether any attack actually succeeded has not been established. Wildberger declined to speculate about who might be behind it, and pushed back on framing the incident as an AI attack — phone spyware, he noted, has existed for a long time. "But it is still something that of course concerns us very much."
What tooling of this class can do, according to the BSI: read messages even inside encrypted messengers, monitor calls, extract contacts and calendars, track location and switch on microphone and camera without the user noticing.
What is unknown matters as much as what is known. No agency has confirmed an infection, no attribution has been offered, and the number of people who received alerts has not been published. Consumer-level checks rarely settle a question like this; the usual next step is forensic examination of the device — or replacing it outright.
For the recipients, the message is blunt: a threat notification means probable targeting, not a diagnosis, and the burden of proof now sits with a forensic examination most of them have not yet had.
