Apple Warns iPhone Users in 99 Countries of Mercenary Spyware Attacks — German Lawmakers Among Those Targeted
Apple has warned iPhone users in 99 countries that they may have been targeted by mercenary spyware, a powerful form of surveillance software sold mainly to governments. Among those who received the warnings are members of Germany’s parliament and federal government, and Berlin has told them to treat their phones as possibly compromised.
The alerts began reaching iPhones on 29 October 2026. Apple has not said who is behind the attacks, and it has not confirmed whether any phone was actually hacked. But the scale of the warning — 99 countries at once — and the fact that elected politicians were among the targets has turned it into one of the biggest spyware stories of the year.
What happened
Apple sends out what it calls “threat notifications” when it believes a specific person has been individually targeted by mercenary spyware. These are not the usual pop-ups about updates or storage. They appear on the phone’s lock screen and in the Settings app, and they warn the owner that they may have been singled out for attack.
In this latest round, the notifications went to targeted users in 99 countries, according to a statement from Apple reported by CyberScoop. The alerts started arriving on 29 October, and the story became public in the first days of November, when German officials confirmed that their own politicians had been warned.
Apple has not published a statement of its own about this round of alerts, and it has not commented on the German case. The 99-country figure comes from the text of the alert itself, which was shared publicly by people who received it.
German lawmakers and ministers were warned
Germany is where the story has had the biggest impact so far. Members of the Bundestag, Germany’s parliament, and officials in the federal government received Apple’s warnings, according to Germany’s Federal Office for Information Security, known as the BSI.
The BSI wrote to members of the Bundestag on 30 October to warn them and to set out the steps they should take. In its letter, the agency said Apple had detected an attack using “mercenary spyware”, which it described as commercially developed, advanced spyware that has often been used by state actors against specific, targeted individuals.
Germany’s digital minister, Karsten Wildberger, confirmed the warnings on Sunday 1 November, in an interview on the German public broadcaster ARD’s programme Bericht aus Berlin. He said there had been “a notification from Apple that certain devices may have been compromised with so-called spyware”, and that members of both the Bundestag and the federal government were among those warned.
The BSI’s advice was blunt. It told recipients to assume, as a precaution, that their device may have been compromised — because the alerts do not show whether an attack actually succeeded. The agency said it did not know whether the notifications meant real infections or only attempted attacks, and it asked recipients to contact the BSI directly for help.
The German government said it was “taking the incident and the warning very seriously” and “working flat out to investigate the circumstances of the incident”. Government spokesperson Stefan Kornelius declined to say whether Chancellor Friedrich Merz was among those who received a warning.
Some of those affected have spoken about it publicly. Franziska Brantner, co-leader of the Green Party, said she was one of the recipients. Hannah Neumann, a German member of the European Parliament, said several foreign policy politicians and staff members received the notifications in this round.
According to The Record, citing the German magazine Der Spiegel, the warnings also reached members of a German delegation of federal ministry staff, lawmakers and journalists who were travelling with Chancellor Merz on a trip through Asia.
Who else received the alerts
Germany was not the only country affected. TechCrunch reported that people outside Germany also received the latest Apple alert, including Radwan Mortada, a documentary filmmaker based in Beirut, Lebanon, who shared his warning on X.
Mortada said he had previously been targeted by Pegasus spyware in 2017 and 2021, and that he did not know who was behind the latest attempt or whether it was connected to an investigative documentary he had directed.
Apple has not published a list of the 99 countries, and neither Apple nor the German authorities have said how many people received the alerts in total. The number 99 describes how far the warnings spread — it does not say how many phones were hacked.
What is mercenary spyware?
Mercenary spyware is Apple’s name for surveillance software that is built by private companies and sold, usually to governments, for large sums of money. It is very different from the viruses and scams that most people worry about.
Ordinary malware tries to infect as many devices as possible, often to steal passwords or money. Mercenary spyware is the opposite: it is aimed at a small number of carefully chosen people — journalists, activists, politicians, diplomats and public officials — because of who they are or what they do.
Once it is on a phone, this kind of spyware can be extremely powerful. Depending on the tool, it can read messages and emails, listen to calls, track the phone’s location, turn on the camera and microphone, and copy photos and files. The best-known example is Pegasus, made by the Israeli company NSO Group. Pegasus has been found on the phones of journalists, human rights workers and politicians in many countries over the past few years.
Apple says its threat notifications are “high-confidence” warnings that a specific person was deliberately targeted. But the company is careful about what it does not say. It does not name the attacker, the country behind the attack, or the company that made the spyware. And it does not confirm whether the attack worked.
That is an important distinction. Receiving the alert means Apple believes someone tried to target you. It does not prove that your phone was successfully broken into.
How the attacks may have worked
The Financial Times reported that the attacks exploited a “zero-click” vulnerability. That means the attackers did not need the victim to tap a link, open a file or do anything at all. According to the report, knowledge of the targets’ phone numbers was all the hackers needed to carry out the attack.
Zero-click attacks are among the hardest to defend against, because there is nothing for the victim to avoid doing. They usually work by sending a specially crafted message — for example, through a messaging app — that triggers a flaw in the phone’s software as soon as it arrives, even before the user sees it.
Not every report agrees on this detail. Some coverage of the story notes that no specific vulnerability has been publicly identified for this round of attacks, and no attacker has been named. What is clear is that Apple judged the threat serious enough to warn users in 99 countries at once.
This is not the first time Apple has sent out warnings on this scale. The company’s previous major round of notifications went out on 13 August 2026 and covered users in 110 countries. With this latest batch, Apple has now notified users in more than 150 countries in total since the programme began in 2021.
What to do if you receive an Apple threat notification
Apple’s advice to anyone who receives one of these alerts is simple: take it seriously and get expert help. The company publishes guidance on its support website under the title “About Apple threat notifications and protecting against mercenary spyware”.
The main steps Apple recommends are:
1. Update your iPhone
Make sure your phone is running the latest version of iOS. Apple regularly fixes security flaws in its software updates, and an old version may still have the weakness the attackers used. Go to Settings, then General, then Software Update, and install anything that is waiting.
2. Turn on Lockdown Mode
Lockdown Mode is a special setting on the iPhone that sharply limits what the phone can do, in exchange for much stronger protection. When it is on, many features that attackers use to break in — such as message attachments, link previews and some web technologies — are blocked or switched off.
To turn it on, go to Settings, then Privacy and Security, then Lockdown Mode, and follow the steps. Apple designed it for people who believe they may be personally targeted, such as journalists and politicians. It is not something most people need for everyday use, but for someone who has received a threat notification, Apple says it is worth considering.
3. Get expert help
Apple advises recipients to seek help from a specialist organisation. In Germany, the BSI told recipients to contact its Service Center directly. There are also independent groups, such as the Citizen Lab at the University of Toronto and Amnesty International’s Security Lab, that help people check whether their phones have been compromised.
It is also wise to think about what is on the phone. If a device may have been compromised, passwords, private messages and sensitive contacts should all be treated as potentially exposed until the phone has been checked or replaced.
Why this story matters
There are three reasons this warning deserves attention, even if you did not receive one.
First, the targets. When spyware is aimed at elected politicians, government officials and journalists, it is not just a personal problem for the people involved. It can affect how a government works, what a journalist can safely report, and how free a country’s public debate really is. A politician who suspects their phone is being watched may think twice before speaking openly.
Second, the timing. The warnings became public just days before a meeting in Paris on 11 and 12 November, where countries are due to discuss voluntary rules for the spyware industry under a process known as the Pall Mall Process. The process, launched by the United Kingdom and France in 2024, aims to curb the abuse of commercial spyware. A code of conduct for governments, backed by 27 countries, is being prepared, and industry guidelines for the companies that build and sell these tools are expected to be unveiled at the Paris meeting. The fact that a major spyware campaign surfaced on the eve of those talks is unlikely to be a coincidence in the eyes of the researchers watching the process.
Third, the reminder. Most people will never be targeted by mercenary spyware — Apple says the attacks are aimed at a small number of people because of who they are. But the tools exist, they are sold to governments, and they are used. The same technology that can silently break into a minister’s phone can also be turned on a journalist, an activist or a lawyer. The defences are the same ones that protect everyone: keep your software updated, be careful with links and attachments, and use the strongest security settings your phone offers.
What happens next
The investigation in Germany is continuing. The BSI has not said how many politicians received the alerts, who they were, or who is behind the attacks. Apple has not commented on the German case, and neither Apple nor the German authorities have named the attacker or the spyware involved.
The Pall Mall Process meeting in Paris on 11 and 12 November will be the next big moment for this story. Researchers and campaigners will be watching whether governments agree on real limits for a trade that has, until now, operated with very few rules.
For the people who received the warnings, the next step is practical: get their phones checked, update their software, and decide whether to use Lockdown Mode. For everyone else, the lesson is simpler — the phone in your pocket is a powerful computer, and keeping it updated is the single easiest thing you can do to protect it.
Frequently asked questions
What is an Apple threat notification?
It is a warning Apple sends when it believes a specific person has been individually targeted by mercenary spyware. It appears on the iPhone’s lock screen and in the Settings app. Apple says these are high-confidence alerts, but they do not confirm that a phone was successfully hacked.
Does the alert mean my iPhone has been hacked?
Not necessarily. The alert means Apple believes someone tried to target you. It does not say whether the attack worked. Germany’s BSI has said it does not know whether the alerts in this round mean real infections or only attempted attacks.
Who received the alerts this time?
Apple said the latest batch went to targeted users in 99 countries. Those known to have received them include members of Germany’s Bundestag and federal government, as well as a documentary filmmaker in Beirut. Apple has not published a list of the countries or the people affected.
What is mercenary spyware?
It is advanced surveillance software built by private companies and sold mainly to governments. It is aimed at a small number of specific people, such as politicians, journalists and activists. The best-known example is Pegasus, made by NSO Group.
What should I do if I get one of these alerts?
Update your iPhone to the latest version of iOS, consider turning on Lockdown Mode in Settings under Privacy and Security, and seek expert help. In Germany, the BSI has asked recipients to contact its Service Center.
Has this happened before?
Yes. Apple has been sending threat notifications since 2021 and has now warned users in more than 150 countries in total. The previous major round, in August 2026, covered users in 110 countries.
Conclusion
Apple’s warning to iPhone users in 99 countries is a reminder that the most serious cyber threats are not always aimed at everyone — sometimes they are aimed at a few people who matter. German lawmakers, government officials and a filmmaker in Beirut were among those told they may have been targeted, and Berlin has told them to assume the worst until their phones are checked.
Nobody has said who is behind the attacks, and nobody has confirmed that any phone was actually broken into. But the scale of the warning, and the people it reached, show that mercenary spyware remains a live threat to politicians, journalists and public life — and that the debate over how to control it, due to continue in Paris this week, could not be more timely.
Sources
- 9to5Mac, “Apple recently notified users in 99 countries of potential mercenary spyware attacks”, 2 November 2026: https://9to5mac.com/2026/11/02/apple-recently-notified-users-in-99-countries-of-potential-mercenary-spyware-attacks/
- BetaNews, “Apple spyware alerts 99 countries”: https://www.betanews.com/article/apple-spyware-alerts-99-countries/
- iGeeksBlog, “Apple mercenary spyware threat notifications 99 countries”: https://www.igeeksblog.com/apple-mercenary-spyware-threat-notifications-99-countries/
- Security Affairs, “Apple’s spyware notifications reach the Bundestag — what the BSI says to do now”: https://securityaffairs.com/202297/intelligence/apples-spyware-notifications-reach-the-bundestag-what-the-bsi-says-to-do-now.html
- ZeroDayFeed, “Apple mercenary spyware warnings 99 countries German lawmakers November 2026”: https://zerodayfeed.com/article/apple-mercenary-spyware-warnings-99-countries-german-lawmakers-november-2026
- SofX, “Germany warns officials of mercenary spyware following Apple alerts in 99 countries”: https://www.sofx.com/germany-warns-officials-of-mercenary-spyware-following-apple-alerts-in-99-countries/
- iPhoneWired, “Apple spyware warnings”: https://iphonewired.com/news/1200282/
This article is for general information and education only. It is not legal or financial advice.
