Apple warns iPhone users in 99 countries of spyware; Germany’s Bundestag confirmed as a target

Apple sent threat notifications to users in 99 countries starting October 30, 2026 – in Germany they reached lawmakers and government staff, and security researchers say the same alert system has flagged US-based targets before.

Apple has sent a new wave of “threat notifications” to iPhone users it believes were targeted by mercenary spyware, reaching 99 countries according to the notification text itself. In Germany, the warning reached members of the Bundestag and federal government; whether any US recipients are among this specific wave has not been confirmed, since Apple does not publish a country breakdown.

The alerts began arriving on affected devices on Friday, October 30, 2026 – the second such wave in eleven weeks, after Apple’s mid-August notification round reached roughly 110 countries. Apple’s support page for the program still shows the August wording, and the company has issued no separate public statement about the October wave; the 99-country figure comes from the notification text itself, reported by the security researcher who first published it.

Apple never attributes these attacks to a specific government or vendor, and does not confirm that a device was actually compromised – only that it was identified as a likely target of a sophisticated, individually targeted attack.

What happened in Germany

Germany is the one country confirmed, so far, to be among the 99: Germany’s Federal Office for Information Security (BSI) told affected members of the Bundestag and of the federal government to treat their iPhone as compromised, disconnect it from Wi-Fi and cellular networks, turn on Lockdown Mode, and have the device examined forensically – even though the BSI said it knew of no confirmed successful breach at the time. German digital minister Karsten Wildberger confirmed the incident on public broadcaster ARD, saying the BSI had “acted very quickly” and contacted those affected immediately; he gave no numbers or names.

No comparable confirmation exists yet for the United States regarding this specific October wave. Apple’s threat-notification program has, however, a documented history of flagging US-based recipients in earlier rounds since 2021, including journalists and people connected to government and diplomatic work, based on past public reporting about the program.

How Apple’s threat notifications work

Apple has run this alert system since 2021 and says it has, by its own account, notified users in more than 150 countries in total. An earlier wave in August 2026 reached around 110 countries.

„Apple threat notifications are high-confidence alerts.“

Apple, support document “About Apple threat notifications and protecting against mercenary spyware”

In practice, Apple only sends these alerts when its own threat intelligence gives it high confidence that a device was targeted in a sophisticated, individually targeted attack, as opposed to ordinary cybercrime or malware. Apple says genuine notifications only ever arrive through three channels: a notice directly on the iPhone, an email from threat-notifications@email.apple.com, and a banner shown after signing in at account.apple.com.

Those are the only ways to verify a notification is genuine. Apple never asks recipients to click a link, download a file, enter a password, or provide a verification code as part of a threat notification.

What this means for US iPhone owners

Because Apple does not disclose which of the 99 countries received notifications in this wave, there is no way to confirm from the outside whether US recipients are among them this time. Anyone in the United States who genuinely receives an Apple threat notification should follow the same steps German authorities recommended to affected Germans: treat the device as potentially compromised, enable Lockdown Mode, and get independent technical help rather than attempting to clean the phone alone.

The US Cybersecurity and Infrastructure Security Agency (CISA) has published broader warnings this year about spyware campaigns targeting secure messaging apps, underscoring that mercenary surveillance tools remain an active concern for government, journalists and civil-society targets in the US as elsewhere, even though CISA has not commented specifically on this October Apple notification wave.

Who is behind mercenary spyware

It remained unclear at the time of publication who carried out the attacks behind this wave. Apple deliberately withholds the vendor name and the exploited vulnerability, to avoid handing attackers additional information. In reporting on earlier waves, the Pegasus spyware built by Israel’s NSO Group – a company the US government placed under export restrictions in 2021 – has repeatedly served as a reference point for what such tools can do; there is, on current evidence, no confirmed link between Pegasus and this specific wave.

Security researchers say spyware of this kind can read encrypted messages, call logs, contacts, calendar entries and location data, and can remotely activate a device’s camera and microphone. Some such attacks rely on so-called zero-click vulnerabilities, for example via iMessage, where the victim does not need to click anything at all.

Researchers estimate that a single successful attack of this sophistication often costs several million dollars – one reason journalists, activists, diplomats and politicians remain the classic targets rather than the general public.

Internationally, the UK and France have driven the so-called Pall Mall Process since 2024, an initiative against the misuse of commercial surveillance tools that more than two dozen states, including the United States, have joined through a code of practice for governments; a complementary code for vendors of such software is expected to follow, according to the UK government.

How to protect yourself

Anyone who genuinely receives an Apple threat notification should, per Apple’s own guidance, enable Lockdown Mode – an optional protection built into iPhone, iPad and Mac that sharply restricts common attack routes such as message attachments, link previews, and incoming invitations or calls from unknown contacts. Independent technical support is also worth seeking, for example through the round-the-clock Digital Security Helpline run by the nonprofit Access Now.

These basic steps also protect against far more common threats, such as fake Apple emails or SMS phishing – a reason security agencies recommend them regardless of the specific incident.

Sources and status

• Apple: “About Apple threat notifications and protecting against mercenary spyware,” support.apple.com, as of August 13, 2026.
• Germany’s Federal Office for Information Security (BSI): notice to affected members of the Bundestag and federal government, November 1, 2026, reported via bsi.bund.de (in German).
• ARD, “Bericht aus Berlin”: interview with German digital minister Karsten Wildberger, November 2, 2026 (in German).
• TechAeris: “Apple sends new threat notifications,” report on the October 2026 wave citing the notification text, techaeris.com, October 30, 2026.
• US Cybersecurity and Infrastructure Security Agency (CISA): advisory on spyware campaigns targeting messaging apps, cisa.gov.

Research and data as of: November 3, 2026.

Transparency note: AI-assisted tools were used in researching, structuring and writing this article. The sources used are listed in the article. Publication takes place only after manual editorial approval. Country edition based on an article by Net Trends, researched for the United States.