Apple sends new mercenary spyware warnings to users in 99 countries

Apple has sent a new round of threat notifications to iPhone users in 99 countries, with alerts arriving since October 29. The alerts say the person may be targeted with mercenary spyware. Apple has not made a public statement about this batch, so the count comes from alert text people have shared publicly. That same text says Apple has now notified users in over 150 countries in total.

Mercenary spyware is made by private companies and sold to customers, often governments. Governments rarely build it themselves. Apple says these alerts are “high-confidence” signs that a specific person was targeted, and it does not say who is behind the attacks.

Germany’s parliament got the alerts too

Germany’s federal cyber security office, the BSI, warned that members of the Bundestag, the German parliament, and other public figures had received Apple’s alerts. The BSI says recipients have been getting them since October 29. Digital minister Karsten Wildberger has since confirmed that members of the federal government were also warned, and the BSI tells recipients to assume their device may have been compromised.

Government spokesperson Stefan Kornelius told the Financial Times that Berlin is “taking the incident and the warning very seriously.” He declined to say whether Chancellor Friedrich Merz was among those targeted. Taking the warning seriously is the right answer. Declining to say is a cautious move, though, and it leaves the first question people will ask unanswered.

The 99-country count shows reach, not victims

In August, Apple sent alerts to users in 110 countries. This round came about 11 weeks later. The count tells you how far the notices went. It doesn’t tell you how many phones were compromised.

Radwan Mortada, a Beirut-based filmmaker, shared his notice on X. It said Apple had detected “another attack against your device.” He says he was targeted before, in 2021. I’d read 99 as a measure of how wide the targeting is, not a count of hacked phones.

The alert confirms targeting, not a successful attack

Apple calls these alerts a sign that a user has been individually targeted. They don’t confirm that an attack worked. The BSI makes the same point: the notice doesn’t say whether the attack succeeded.

Spyware like this often uses zero-click attacks, which need no click or action from the target. The BSI points to frequent crashes and fast battery drain as signs that a device may be infected.

What to do if you get one

Real alerts can show up on the Lock Screen, in Settings, by email, or at account.apple.com. Scam messages can copy that look, so check the details before you act.

1. Don’t tap links, open files, or install profiles from the alert. Apple says its notices never ask for those, or for your Apple Account password or a verification code.
2. Check the notice on your Apple Account. Sign in at account.apple.com. A genuine notice shows at the top of the page.
3. Update iOS right away, unless experts are already examining the phone. The BSI gives this advice.
4. If you think you could be a target, turn on Lockdown Mode and get expert help. Apple points to a nonprofit helpline, Access Now’s Digital Security Helpline. The BSI notes that Lockdown Mode makes new attacks harder, but it doesn’t remove an infection that is already there.

Most iPhone owners won’t need Lockdown Mode, but if you think you could be a target, it’s the setting I’d turn on first.

Fake Apple security alerts are a different problem. They are scam pop-ups that claim your iPhone is infected. Apple doesn’t show virus pop-ups in Safari, so force-close the browser instead of tapping anything in the pop-up.

Update your iPhone today, whether or not you got an alert.