Apple mercenary-spyware threat-notification wave, late October 2026

Apple's mercenary-spyware threat notifications of late October reached Bundestag members and federal-government staff in Germany; BSI tells recipients to treat the iPhone as possibly compromised, update, keep Lockdown Mode on and consider replacing the device; no actor or vector is public

Apple has sent a new round of threat notifications to suspected mercenary-spyware targets in 99 countries, according to a notification screenshot posted by the researcher Costin Raiu, who says he verified several victims' notices (The Record, 2026-11-02). Germany's BSI says several Bundestag members and other public figures have received it since 2026-10-29, that it does not know whether the alerts mean actual compromise or only attempted attacks, and that it wrote to the members on 2026-10-30 (translated from German) (BSI, 2026-11-02). Germany's digital minister confirmed that members of the federal government were also warned (Euronews, 2026-11-02), and The Record, citing Der Spiegel, reports that staff of federal ministries, lawmakers and journalists travelling with the Chancellor in Asia were among the recipients (The Record, 2026-11-03). Apple attributes nothing to any actor or region (Apple, 2026-08-13), and neither Apple nor BSI has named a spyware vendor or an infection vector. BSI notes that mercenary spyware is generally assumed to infect devices without any action by the user, for example through a prepared message that need not be opened, and that a compromised device exposes messages including those in encrypted messengers, calls, contacts, calendar, location, camera and microphone (BSI, 2026-11-02).

BSI's guidance for a recipient: assume the device may be compromised; update the operating system at once unless a forensic analysis is intended; keep Lockdown Mode on permanently, also on a new device, noting that it hampers new attacks but does not remove an existing infection; where the risk looks high, consider replacing the device, resetting every account used on it and changing the phone number; then set a new device passcode, change the Apple Account and mail passwords, re-enrol authenticator apps instead of transferring them, enable Signal's registration lock and WhatsApp's two-step verification with new PINs, remove linked devices nobody recognises, and report the notification to BSI's service centre (BSI, 2026-11-02).

Triage: a genuine notification never asks to click a link, open a file, install an app or profile, or give a password or verification code; a message that does is a phishing imitation, and the recipient should open account.apple.com directly in the browser instead (Apple, 2026-08-13).