Μake us preferred on Google The German government says it is seriously concerned that spyware may have compromised the iPhones of members of the Bundestag and government officials.
Digital Affairs Minister Karsten Wildberger told public broadcaster ARD on Sunday that the case involved notifications from Apple warning that certain devices may have been infected with spyware. He gave no further details but said he was concerned by the reports.
Alerts since Thursday
According to a letter reported by ARD, the affected iPhones began receiving Apple threat notifications on October 29, warning that an attack using so-called “mercenary” spyware had been detected. The Federal Office for Information Security (BSI) quickly contacted everyone affected in writing and issued an urgent notice over the weekend. Its advice was that anyone who received such an alert should, as a precaution, treat their device as no longer secure.
The BSI said it had no additional information so far on the specific cause or background of the notifications. Apple describes its threat notifications as highly reliable warnings that a person has been deliberately targeted, though they do not show whether an attack actually succeeded. Apple did not immediately respond to a request for comment.
Stefan Kornelius, spokesman for Chancellor Friedrich Merz, said on Monday that the government was treating the incident and the warning very seriously and that authorities were working intensively to investigate and to inform and support those affected. He would not say whether the chancellor was among those targeted.
A “zero-click” attack
According to the Financial Times, the attack exploited a “zero-click” vulnerability, meaning the phones could be infected without their owners clicking a link or opening a file. The attackers needed only the targets’ phone numbers.
No one has yet been publicly blamed, but security officials believe the attack is almost certainly state-backed. The spyware, which has not been named, was commercially developed and has been used by several governments in the past, officials said.
Spyware secretly monitors or collects a user’s data and activity without their knowledge, often sending it to third parties. It can be installed by exploiting software flaws or through deceptive methods. The BSI said attackers could use it to read messages, including those on encrypted apps, and to access calls, contacts, calendars and location data, as well as switch on the phone’s microphone and camera. The best-known tool of this kind is Pegasus, made by Israeli company NSO, which can also reach photos and documents and turn phones into listening devices.
A history of attacks on German politicians
German lawmakers and officials are prized targets for hostile intelligence services. This spring, several dozen MPs were compromised in a phishing campaign aimed at users of the encrypted messaging app Signal, with Bundestag President Julia Klöckner the most prominent among them.
Russian hacking groups tied to the country’s intelligence services have been the most active. APT 28, also known as “Fancy Bear” and controlled by Russia’s military intelligence agency GRU, hacked Germany’s Social Democratic Party in 2022. The same group carried out the 2015 attack on the Bundestag, stealing about 16 gigabytes of data from computers used by senior figures across all parties. Germany formally blamed Russia in 2020 and lodged a complaint with Moscow’s ambassador.
In 2016, hackers linked to Russia’s FSB also breached the Berlin-Bonn information network, a secure system used by German ministries, accessing classified documents on the war in Ukraine and the Brexit negotiations then underway.
