Berlin—The German federal government has escalated its cybersecurity posture, issuing urgent warnings to high-ranking politicians and public figures after they were identified as targets of sophisticated, government-backed spyware. This development arrives in the wake of a massive wave of security notifications dispatched globally by Apple, alerting potential victims that their iPhones may have been compromised by state-sponsored surveillance tools.
Germany’s Federal Office for Information Security, widely known by its German acronym BSI (Bundesamt für Sicherheit in der Informationstechnik), released an advisory over the weekend confirming that several members of the Bundestag—the German federal parliament—alongside other notable individuals, had received direct threat notifications from Apple. These alerts indicate that specific devices were targeted by advanced cyberattacks leveraging mercenary spyware.
While government spokespersons have emphasized the gravity of the situation, the identities of the targeted officials remain closely guarded. As cybersecurity threats grow increasingly complex and pervasive, the incident underscores the vulnerability of high-profile political figures to sophisticated digital espionage, igniting renewed debates over state-sponsored surveillance, the commercial spyware market, and the digital resilience of democratic institutions.
Official Responses and Government Posture
Addressing the media following the disclosures, German government spokesperson Stefan Kornelius stated that the administration in Berlin was taking the incident and the associated warnings "very seriously." However, officials have maintained a strict policy of discretion regarding the specific identities of those targeted within the federal government, declining to comment on whether high-ranking members of the administration, including Chancellor Friedrich Merz, were among the recipients of Apple’s threat notifications.
The BSI’s advisory adopts a posture of extreme caution. Because Apple’s threat notifications do not definitively confirm a successful device breach—and explicitly avoid attributing attacks to specific threat actors or governments—the German cybersecurity agency has instructed all recipients to operate under the assumption that their devices have indeed been compromised.
The German federal police and intelligence services are currently coordinating with international partners to assess the scope of the attacks. The BSI has urged all affected individuals to hand over their devices for forensic analysis, implement strict communication protocols, and adopt specialized lockdown modes on their mobile hardware to mitigate ongoing risks.
The Mechanics of Mercenary Spyware
The recent wave of attacks brings renewed attention to the mechanics of modern digital espionage, which frequently relies on what the cybersecurity industry terms "mercenary spyware." Unlike traditional malware that requires a user to interact with a malicious link, open an infected email attachment, or download an unverified application, advanced mercenary spyware often utilizes "zero-click" exploits.
Zero-click exploits operate invisibly in the background. They can infiltrate a smartphone by exploiting previously unknown vulnerabilities—known as zero-day flaws—in the device’s operating system or standard communication apps. Once inside, the spyware grants the operator deep, root-level access to the device. This allows malicious actors to covertly harvest encrypted messages, track real-time location data, activate cameras and microphones without user consent, and exfiltrate sensitive documents and photographs.
Apple has maintained a proactive stance against these clandestine operations, periodically issuing threat notifications to users worldwide whom internal telemetry and threat-intelligence analysis suggest have been targeted by state-sponsored actors. According to documentation provided by Apple to affected users, the most recent batch of notifications reached individuals across 99 countries, illustrating the truly global and indiscriminate nature of these campaigns.
Global Reach and High-Profile Targets
The targeting of German parliamentarians is part of a much broader, international espionage campaign. Outside of Europe, civil society members, journalists, and activists have reported receiving identical warnings from Apple.
Radwan Mortada, a prominent Beirut-based investigative filmmaker, took to social media platform X to share that he had received a new threat notification from Apple. The alert warned that the tech giant had detected "another attack against your device." Mortada is no stranger to digital surveillance; he was previously targeted by sophisticated spyware in 2021 during his reporting on regional conflicts and political corruption.
Security researchers note that journalists, human rights defenders, dissidents, and opposition politicians are frequently the primary testing grounds and targets for mercenary spyware. By infiltrating the devices of individuals who hold sensitive institutional knowledge or critical investigative insights, threat actors can map out opposition networks, anticipate political movements, and neutralize critical voices under a cloak of plausible deniability.
The Murky Business of the Commercial Spyware Industry
The proliferation of these cyberattacks highlights the controversial and largely unregulated nature of the commercial spyware industry. Sovereign governments rarely possess the internal technical capability or resources to develop zero-click exploits from scratch. Instead, they procure these advanced cyber-weapons from private, profit-driven companies often referred to as mercenary spyware vendors.
The most prominent player in this ecosystem is Israel’s NSO Group, the creator of the notorious Pegasus spyware. Pegasus has been implicated in numerous global scandals involving the surveillance of journalists, human rights activists, and political figures. Despite international outcry and subsequent United States government sanctions against NSO Group and similar firms, the market for commercial spyware has proven remarkably resilient, with new boutique exploit brokers continually emerging to fill regulatory gaps.
The presence of these tools within Germany is not entirely unprecedented. Investigative reports previously revealed that Germany’s central federal law enforcement agency, the Federal Criminal Police Office (BKA), secretly acquired access to the Pegasus spyware in 2019 for specific investigative mandates. However, the unauthorized or untracked use of such tools against domestic political figures by foreign or adversarial state actors represents a severe national security threat.
Implications for Cybersecurity and Democratic Institutions
As geopolitical tensions rise and state-backed cyber warfare becomes a standard instrument of foreign policy, the recent targeting of German lawmakers serves as a stark wake-up call for Western democracies.
Cybersecurity experts emphasize that traditional perimeter security and standard mobile device management (MDM) solutions are often inadequate against state-sponsored zero-click attacks. Lawmakers, diplomats, and civil servants are prime targets because they sit at the intersection of critical national infrastructure, classified policymaking, and international diplomacy.
The incident is expected to accelerate legislative efforts within the European Union to crack down on the export, sale, and use of mercenary spyware. Lawmakers across Europe have increasingly argued that the commercial spyware industry poses an existential threat to privacy, freedom of the press, and democratic governance.
For the German government, the immediate priority remains containment and forensic verification. As the BSI continues its investigation into the extent of the latest compromise, the episode reinforces the uncomfortable reality that in the digital age, the personal smartphone of a parliamentarian is quite literally a pocket-sized battlefield.
