An Apple spyware alert has landed on devices in 99 countries, marking one of the broadest waves of threat warnings the company has ever issued. The notifications caution recipients that they may have been singled out by mercenary spyware, the kind of sophisticated surveillance tool typically sold to governments and deployed against journalists, activists, and political figures. The timing is significant: German authorities are now investigating whether members of parliament and senior officials were among those targeted.

What the Latest Apple Spyware Alert Means

Apple runs a threat notification program designed to warn individuals it believes have been the focus of highly targeted attacks. These are not everyday phishing attempts or mass malware campaigns. Mercenary spyware is expensive, precise, and usually reserved for a small number of people of interest to whoever is paying for it.

The company is deliberately cautious about what it reveals. An Apple spyware alert does not confirm that a device has actually been breached, nor does it name a suspected attacker. Instead, the message informs the user that their account or device may have been targeted and strongly encourages them to treat the situation as serious and consult security specialists. Apple also directs recipients toward its own guidance on hardening devices, including switching on Lockdown Mode, a setting that restricts certain features to shrink the attack surface.

These warnings go out periodically rather than on a fixed schedule. Previous rounds have reached users across dozens of countries, but a batch covering 99 nations suggests an unusually wide operation, or possibly several campaigns detected at once.

Germany Reacts With an Urgent Warning

The most consequential fallout so far has been in Germany. According to reporting from major outlets, lawmakers and government staff started receiving Apple’s notifications late last week. The scale and sensitivity of the recipients prompted the Federal Office for Information Security, known as the BSI, to issue an emergency advisory over the weekend.

The agency’s message was blunt. Anyone who received the warning was told to operate on the assumption that their phone could no longer be trusted. That is strong language from a national cybersecurity body, and it reflects how difficult it is to verify whether advanced spyware has already taken hold.

The federal government confirmed it regards the matter as a serious incident and said investigators are working intensively to piece together what happened. A spokesperson declined to confirm whether Chancellor Friedrich Merz was personally affected, which has only fueled speculation about how high the targeting may have reached.

A Zero-Click Attack That Needs Only a Phone Number

One detail stands out in the German case. The intrusions reportedly relied on a zero-click vulnerability. In practical terms, that means victims did not have to open a link, download a file, or respond to a message. The exploit could compromise a device silently, with no action from the owner whatsoever.

Even more alarming, the attackers apparently needed nothing more than a target’s phone number to launch the attempt. For public officials, whose contact details often circulate widely, that is a very low barrier.

Zero-click exploits are among the most prized tools in the surveillance industry precisely because they leave victims with almost no way to protect themselves through ordinary caution. Standard advice about avoiding suspicious links offers no defense. This is why Apple pushes Lockdown Mode so firmly: by disabling features such as certain message attachments and web technologies, it closes many of the pathways these exploits depend on.

Targets Beyond Germany

While Germany has dominated headlines, the alerts clearly extended far beyond Europe. Among those who went public was Radwan Mortada, a filmmaker based in Beirut, who shared a screenshot of his notification on social media. His message from Apple indicated that this round of warnings had been delivered to users in 99 countries.

Mortada’s case illustrates a troubling pattern. He said he had already been hit by Pegasus spyware twice before, in 2017 and again in 2021. Pegasus, developed by the Israeli firm NSO Group, became the most notorious example of mercenary surveillance software after investigations revealed it had been used against reporters, dissidents, and even heads of state.

Mortada said he does not know who is behind this newest attempt, nor whether it relates to an investigative documentary he recently directed. That uncertainty is common. Victims rarely learn who paid for the attack, and attribution often takes months of forensic work by specialist researchers.

Why Attribution Remains a Mystery

At this stage, no one has publicly identified the spyware vendor or the government customer behind the campaign. Apple’s policy of not naming suspects means the company’s alerts offer no clues. Investigators in Germany have not pointed fingers either.

Several factors make attribution difficult:

Mercenary spyware is sold to multiple state clients, so a single tool can appear in unrelated campaigns.
Zero-click exploits leave minimal traces, and attackers often delete evidence after extracting data.
Governments accused of surveillance rarely admit involvement, and vendors cite confidentiality.
Independent labs that specialize in this analysis need physical or forensic access to affected devices, which many victims are reluctant to provide.

Until researchers publish technical findings, the most likely scenarios will remain educated guesses.

What Users Should Do if They Receive a Warning

For the vast majority of iPhone owners, these alerts are not relevant. Mercenary spyware is aimed at specific individuals, not the general public. Still, anyone who does receive a notification should act quickly and methodically:

Take the message seriously rather than dismissing it as a scam. Apple delivers these through official channels, including the Apple Account page and email.
Enable Lockdown Mode immediately to reduce exposure to further exploitation.
Update the device to the latest software version, since patches frequently close the vulnerabilities spyware relies on.
Contact a digital security organization or forensic expert. Groups that support journalists and civil society often provide free assistance.
Consider using a separate, clean device for sensitive communication until the original has been examined.

The Bigger Picture

This latest Apple spyware alert is a reminder that commercial surveillance tools remain a persistent threat to democratic institutions and press freedom. When elected lawmakers in a major European country are advised to treat their phones as compromised, the issue moves from a niche security concern to a matter of national governance.

Apple’s notification program has become one of the few early-warning systems available to potential victims. Its reach across 99 countries in a single wave shows both the value of that system and the troubling scale of the industry it is trying to counter. The German investigation may eventually shed light on who was responsible, but for now, the message to high-risk users is clear: assume you are a target, lock down your device, and seek expert help without delay.