Germany says lawmakers’ iPhones may have been hacked with spyware

The sophistication of spyware capable of "zero-click" attacks on iPhones is now a confirmed threat to high-profile individuals globally.

Germany's federal cybersecurity office (BSI) has warned politicians and public figures that their iPhones may have been compromised by government-backed spyware. This warning follows recent threat notifications sent by Apple to users worldwide, indicating potential targeting by sophisticated cyberattacks. The BSI advises that recipients of these Apple alerts should assume their devices might be compromised, as the spyware can steal sensitive data through "zero-click" exploits, requiring no user interaction. While Apple does not attribute these attacks to specific actors or confirm actual breaches, the German government is taking the incident very seriously. The exact perpetrators and specific targets within Germany remain unclear, though individuals in 99 countries have reportedly received similar alerts. This situation underscores the pervasive threat of mercenary spyware, often acquired by governments from private vendors.

The widespread nature of Apple's threat notifications, reaching users in 99 countries, suggests a significant and coordinated campaign by state-sponsored or state-affiliated actors. This broad reach, combined with the "zero-click" exploit methodology, highlights a potent and increasingly accessible tool for surveillance that can bypass conventional security measures. The German government's serious acknowledgment of the threat and its directive for recipients to assume compromise underscores the gravity of the situation for public officials and sensitive organizations.

This event signifies a critical escalation in the global spyware arms race, where mercenary spyware developers are providing powerful tools that can be leveraged by numerous governments. The reliance on private vendors, rather than in-house development, suggests a growing market for these offensive cyber capabilities, making them available to a wider array of state actors. The implications extend beyond individual privacy, potentially impacting political stability and national security as critical infrastructure and government communications become more vulnerable to sophisticated, untraceable intrusions.