German Digital Minister Karsten Wildberger confirmed on November 1, 2026, that several members of the Bundestag and federal government officials have been targeted by mercenary spyware. The development follows a wave of threat notifications sent by Apple to users in 99 different countries, alerting them that state-sponsored or mercenary actors may have attempted to compromise their iPhones.
The notifications, which began appearing on October 29, 2026, reached high-ranking officials within the German government. According to reports from Der Spiegel, the targeting specifically included members of the delegation that recently accompanied Chancellor Friedrich Merz on a diplomatic trip to Singapore, Japan, and South Korea. While the alerts confirm that these individuals were targeted, they do not provide definitive evidence that every device was successfully breached.
However, Germany’s Federal Office for Information Security (BSI) has issued a high-severity precautionary instruction to those affected. The BSI advised recipients of the Apple alerts to operate under the assumption that their devices are compromised until a thorough forensic analysis can prove otherwise.
This incident is part of a broader global surge in mercenary spyware activity. Beyond the German political sphere, other high-profile individuals have reported receiving similar warnings during this window. Radwan Mortada, a Beirut-based filmmaker who has been targeted by Pegasus spyware in previous years, confirmed receiving a new notification during this current wave. According to 9to5Mac, Apple’s latest alerts are designed to warn users who are specifically targeted due to their profession, activism, or political standing.
The spyware in question is often “zero-click,” meaning it can infect a device without the user interacting with a malicious link or file. These sophisticated exploits typically target vulnerabilities in messaging apps or system processes to gain deep access to microphones, cameras, and encrypted messages. Apple has not attributed this specific wave of attacks to any particular state actor or commercial spyware product, such as the NSO Group’s Pegasus or Intellexa’s Predator.
To mitigate the risk of such highly targeted attacks, both Apple and the BSI recommend that at-risk individuals enable Lockdown Mode. This extreme security setting significantly reduces the iPhone’s attack surface by disabling certain web technologies, blocking most message attachments, and restricting incoming FaceTime calls from unknown numbers. As reported by The Next Web, the BSI continues to coordinate with international partners to determine the origin of the attempts and the specific vulnerabilities being exploited.
For those who receive a threat notification, security experts suggest immediately seeking assistance from organizational IT departments or specialized digital rights groups. Standard security practices, such as keeping software updated and using two-factor authentication, remain essential for general users, though they may not be sufficient on their own to stop the specific class of mercenary spyware currently being deployed against political targets.
