Key takeaways
- Apple sent a new wave of mercenary spyware warnings to targeted users in 99 countries starting October 29. In Germany, members of the Bundestag and the federal government got them, and the BSI told them to assume their phones may be compromised.
- According to the Financial Times, it was a zero-click attack: the attackers needed only a phone number. Apple, as always, does not say who is behind it, how they got in, or whether any phone was actually hacked.
- My view: this is a state, not ordinary hackers, and Apple is afraid to name it. The myth of Apple’s safest software broke for me this year, and I wouldn’t put Apple’s camera in my home after this.
Starting October 29, 2026, Apple sent a new round of threat notifications to people it believes were individually targeted by mercenary spyware: commercial spying tools that companies sell, mostly to governments. According to the notice, shared on X by Lebanese journalist Radwan Mortada, this wave reached targeted users in 99 countries. Apple has sent these warnings several times a year since 2021 and says it has reached users in more than 150 countries in total; in August, it reached 110 countries and started showing the alert directly on the iPhone’s Lock Screen.
In Germany, members of the Bundestag and the federal government received the warning, Digital Minister Karsten Wildberger confirmed. Germany’s Federal Office for Information Security (BSI) wrote to them on October 30 that they “should assume that their device may have been compromised.” Government spokesperson Stefan Kornelius said Berlin is taking the warning “very seriously,” but declined to say whether Chancellor Friedrich Merz was among those targeted. According to the Financial Times, the attack used a zero-click vulnerability, and knowing the target’s phone number was enough. Apple does not name the attackers, does not confirm whether any device was compromised, and nobody has said whether the vulnerability is fixed.
| Apple threat notification wave | Countries reached |
|---|---|
| April 2024 | 92 |
| July 2024 | 98 |
| August 2026 (first Lock Screen alerts) | 110 |
| October/November 2026 | 99 |
| Total since 2021 | More than 150 |
In this article: Five years of warnings, and never a name · A phone number is all they need · The myth of Apple’s safest software · Germany bought Pegasus, now it plays the victim · Why Apple walked away from NSO · And Apple wants a camera guarding your home · Russia is not Apple’s problem · Got the warning? What I would do · FAQ
Five years of warnings, and never a name
Apple has been warning people for five years and still never says who is behind it. In my opinion, there is a very high probability that it is some agency, some government or some country that Apple is afraid to name out loud. It knows the consequences for Apple could be very big, or it simply doesn’t want to start a conflict between countries.
These are certainly not ordinary hackers. If it were ordinary hackers, Apple would surely not be afraid to write exactly who it was. Apple says it keeps quiet because revealing more would help attackers avoid detection. Maybe. But after five years and more than 150 countries, the silence says more than any name would.
A phone number is all they need
This is what scares me the most. The attackers didn’t need a thief, a stolen phone, a click on some link or any detail from the victim. A phone number was enough.
And the longer this goes on, the more attacks there are. The states or the hackers are simply getting smarter. You don’t do anything wrong, you don’t open anything, and your phone may still not be yours anymore. The BSI warns that this kind of spyware can read messages, including in encrypted apps, and switch on the camera and the microphone.
The myth of Apple’s safest software
Until now, I was a big fan of exactly that: the security of our data, the way Apple guarded it. But this year, I think not even Apple is that safe anymore. Lately, hackers and governments keep showing us that what we thought was the safest can, in the end, easily be broken and controlled.
First, more than 400 deepfake apps slipped through the App Store. Now a zero-click attack that needs only a phone number. In September 2025, Apple introduced Memory Integrity Enforcement on the iPhone 17 and called it the most significant upgrade to memory safety in the history of consumer operating systems. Nobody has said which iPhones these victims had, but the warnings keep coming.
Nobody has confirmed that AI was used in this attack. But the better AI gets, the more attacks of all kinds grow around the world, and unfortunately, Apple falls under them too. The stronger the AI brain, the weaker Apple and its hardware that was supposed to keep us safe. So this year, I no longer believe the myth of Apple’s safest software.
Germany bought Pegasus, now it plays the victim
In 2021, the German government admitted to the Bundestag’s interior committee that the federal police, the BKA, had bought a version of NSO Group’s Pegasus spyware. The same state now warns its lawmakers that someone may be spying on them.
The way the German government acts surprised, when it bought Pegasus itself, really doesn’t sound very credible. It’s more of a theater. Let’s not forget that in recent years, politicians also play to the audience, especially now, when the whole world is a bit strange.
Why Apple walked away from NSO
In 2021, Apple sued NSO Group, the maker of Pegasus. In 2024, Apple asked the court to drop its own lawsuit, saying the case could expose the threat intelligence it uses to catch attackers. WhatsApp kept going, and in 2025 a US jury ordered NSO to pay it about $167 million; the judge later cut the damages, but barred NSO from targeting WhatsApp.
I think the truth is that Apple didn’t want to make public how it protects us and how it fixes its software when it finds something wrong. WhatsApp went for it because it probably had nothing to lose. Apple knew it would show publicly how cleverly it built that security for us.
So I actually take it as a plus for Apple. It didn’t want money from NSO at any price, it preferred to keep its secrets. But as we can see, probably in vain. The attackers found their way in anyway.
And Apple wants a camera guarding your home
Just yesterday, I wrote about the HomeView Ultra, a screen with a camera that follows you around your home. And 9to5Mac found code suggesting the HomeView could even double as a HomeKit security camera.
So Apple wants its camera to guard your home, at a time when it can’t keep under control the thing it was proudest of: the security of the iPhone. Imagine thieves who know how to control all of this. Through that camera, they would know almost everything about us. I don’t wish that camera on anyone. Even if Apple convinces us it is mega-secured, I won’t believe it now.
Russia is not Apple’s problem
In October, Russia’s regulator Roskomnadzor added Apple to its state surveillance registry, which obliges companies to store communication data and provide it to Russian security services. Apple suspended sales in Russia in March 2022, and Russia blocked FaceTime in December 2025.
These Russians want too much from the whole world. They act like kings and want to dictate to everyone what to do. I don’t want to get into politics, but Apple certainly has no reason to give in. Officially, Apple doesn’t sell in Russia. If people there use Apple’s devices through other channels, that’s not Apple’s worry. In my opinion, Apple should deal only with the countries where it officially sells and cooperates. A letter would be enough: we don’t officially sell our devices in your country, there is nothing to talk about.
Got the warning? What I would do
A normal person with a normal life, who is not a journalist and is not connected to politics or some secret services, is most likely not the target. These attacks are about states that want to find out something about other states, and about the people around them. If an ordinary person gets a “warning,” it is more likely some strange scam, or they got in the way by mistake.
First, check that it is real. A real Apple threat notification never asks you to click a link, install an app or a profile, open a file, or give a password or a code. Don’t click anything in a message. Sign in to account.apple.com yourself, where real threat notifications are listed.
If the warning is real, I would switch the phone off right away, or at least restart it. You don’t know how far they can get into your device. Then update iOS and go to a specialist. Germany’s BSI also recommends changing passwords and PINs, including in Signal and WhatsApp, and, if the risk is high, a new phone and a new number.
Lockdown Mode, in Settings under Privacy & Security, is for people someone is interested in: politicians, journalists, big people who run states. It turns off many features, links and attachments, and some websites break. For an ordinary person, it’s usually not needed. According to security firm Jamf, no compromise of a device running Lockdown Mode is known.
Also on Evolt News: “Even Apple doesn’t have access”: Apple’s Q4 call · HomeView and the Siri beta · ChatGPT in iCloud? No, thanks
Featured image: Tyler Lastovich / Unsplash.
This article is opinion.
Apple spyware warning in 99 countries: FAQ
What is Apple’s mercenary spyware warning?
It is a threat notification Apple sends when it believes a specific person was targeted by commercial spyware, usually sold to governments. Since August 2026 it appears on the iPhone’s Lock Screen and in Settings, and Apple also sends an email and lists it at account.apple.com.
How many countries got the latest Apple spyware warning?
According to Apple’s notice, the wave that started on October 29, 2026 reached targeted users in 99 countries. Apple says it has notified users in more than 150 countries since 2021.
Who is behind the attacks?
Apple does not say, and German authorities have not named anyone. Apple calls its alerts high-confidence but never attributes them to a specific attacker, country or spyware vendor.
Were German lawmakers’ iPhones hacked?
It is not confirmed. The BSI said it cannot tell whether the alerts reflect successful infections or attempts, and advised recipients to assume their devices may be compromised.
How do I know an Apple spyware warning is real?
A real Apple threat notification never asks you to click a link, install an app or profile, open a file, or share a password or verification code. Sign in to account.apple.com directly to check whether a notification is listed there.
Should I turn on Lockdown Mode?
Lockdown Mode is meant for people at high risk, such as journalists, activists and politicians. It limits many features, so most ordinary users don’t need it. If you got a real warning, Apple and the BSI recommend turning it on and getting expert help.
Sources: Apple, Financial Times, TechCrunch, 9to5Mac, The Next Web, IBTimes UK, CyberInsider, AFP, Malwarebytes, Forbes, MacRumors, Bloomberg.
Our Take
Apple warned people in 99 countries about spyware, and once again it won’t say who is behind it. To me, that means a state Apple is afraid to name. A zero-click attack that needs only a phone number shows that the myth of Apple’s safest software doesn’t hold anymore.
Germany bought Pegasus and now plays the victim, Russia is not Apple’s problem, and Apple wants a camera to guard our homes. If you get a real warning, don’t click anything, switch the phone off, update it and find a specialist.
