German authorities have told officials and lawmakers who received Apple threat notifications this week to assume their iPhones are no longer secure, as an investigation begins into a suspected state-backed spyware campaign. The attack is believed to rely on a zero-click flaw, meaning phones could be infected without any action by their owners. Security officials say the hackers needed only a target's phone number. Officials have not said who is behind it, or whether Chancellor Friedrich Merz was among those affected.
What Berlin has said
Germany's Federal Office for Information Security (BSI) issued an urgent notice over the weekend to government figures, FT has reported. Anyone who received an Apple notification in recent days should treat their device as insecure, the agency said. The government said the alerts began arriving on Thursday. On Monday, Chancellor Merz's spokesman Stefan Kornelius said Berlin was treating the incident very seriously and that devices must be presumed compromised. He added that authorities were working at full stretch to establish what happened and to inform and support those affected.
How the attack works
The FT said the attack exploits a zero-click vulnerability, so no link has to be opened and no file has to be downloaded for a phone to be infected. Knowing the victim's phone number was reportedly all the attackers needed.
Who could be responsible
No conclusions have been drawn about who carried out the hack, though security officials believe it is almost certainly state-backed, according to the FT. The spyware has not been named. Officials describe it as commercially developed and say several governments have used it before. The best-known example of such software is Pegasus, made by Israel's NSO Group. It can read messages, including those sent on encrypted apps, and access contacts, calendars, location data, photos and documents. It can also switch on a phone's microphone to turn the device into a listening tool.
A long record of targeting German politicians
German lawmakers and officials are prized targets for hostile intelligence services, the FT noted. Bundestag President Julia Klockner was the most prominent of several dozen German lawmakers compromised this spring in a phishing campaign aimed at users of the encrypted messaging app Signal. Russian groups linked to the country's intelligence services have been the most active in trying to reach German politicians' secrets. One of them, known as APT28 or Fancy Bear and run by the GRU, was behind a 2022 breach of the Social Democratic Party. It was also responsible for the 2015 hack of the Bundestag, in which about 16 gigabytes of data were taken from computers used by senior members of every German party.
