Apple Sends Mercenary Spyware Alerts to Users in 99 Countries as German Lawmakers Are Among Those Warned

Introduction

In the final days of October 2026, iPhone users in 99 countries received a warning most people never expect to see on their own phone. Apple told them they may have been individually targeted by mercenary spyware, the expensive surveillance software that is usually sold to governments and aimed at a small number of carefully chosen people. The alerts arrived on October 29 and 30, and they quickly became one of the most closely watched technology stories of the week, because the recipients included German lawmakers and government officials.

The story matters for two reasons. First, the scale of the round is wide: Apple says it has now sent threat notifications to users in more than 150 countries since the programme began in 2021. Second, the warning itself is deliberately narrow: it says a person was targeted, not that their phone was successfully hacked. That distinction has shaped everything that followed, from the German cybersecurity agency’s advice to the questions now facing governments that are trying to set rules for the spyware trade. This post sets out what is known, what is still unclear, and what recipients were told to do after the Apple spyware alerts 99 countries November 2026.

1. What Apple told users in this round

1.1 The alerts that arrived on October 29 and 30

Apple sent the latest round of its threat notifications on October 29 and 30, 2026, according to reports based on the alert text shared by recipients and researchers. The notifications appeared on the Lock Screen of the iPhone and inside the Settings app, and they warned that the person may have been singled out by mercenary spyware. Security researcher Costin Raiu was among the first to share the alert’s wording publicly, according to reporting gathered by The Record. On November 2, 9to5Mac reported that the batch had reached targeted users in 99 countries.

Apple did not publish a Newsroom post about this wave, according to the reporting reviewed, so the 99-country figure comes from the alert text itself and from a company statement reported by CyberScoop. That is an important detail, because it means the public record of this round rests on what recipients shared and what news organisations were able to confirm, rather than on a single official announcement. The alert text also said Apple has now notified users in more than 150 countries in total since the programme began.

1.2 Why 99 countries describes reach, not victims

The number 99 is easy to misread. It describes how widely the notices spread, not how many people received one and not how many phones were breached. Apple has not said how many people got alerts in this wave, and no list of the 99 countries has been released. The figure tells readers that the targeting stretched across much of the world; it says nothing about the size of the operation behind it.

The previous large wave went out on August 13, 2026, and covered recipients in 110 countries, about 11 weeks before this round. That comparison shows the programme is active and recurring rather than a one-off event. Each wave reaches a different set of people in a different set of countries, and each time the same questions return: who was chosen, who chose them, and whether any of the attempts succeeded.

2. Why German lawmakers are at the centre of the story

2.1 The warnings inside the Bundestag and the federal government

The German dimension gave the story its sharpest edge. Germany’s Federal Office for Information Security, known as the BSI, warned members of the Bundestag, the German parliament, and other public figures that they had received Apple’s alerts, and told them to treat their devices as possibly compromised. According to reporting, the BSI’s warning letter said the notifications had begun reaching German iPhones on October 29.

The German government said it was taking the incident and the warning very seriously and was working to investigate the circumstances. Digital Minister Karsten Wildberger confirmed the alerts in a television interview on the Sunday after they arrived, but gave no names and no count of those affected. It is purely speculative at this stage what exactly this involves, he said, according to the reporting, a line that captured how little was publicly known even as the warning spread.

2.2 The travelling delegation and the questions around the chancellor

According to The Record, citing Der Spiegel, the notifications went to members of a German delegation of federal ministry staffers, lawmakers and journalists travelling with Chancellor Friedrich Merz on a trip through Asia. That detail raised the stakes, because it suggested the targeting may have touched people travelling with a head of government rather than only people sitting in offices in Berlin.

German government spokesperson Stefan Kornelius declined to say whether Chancellor Merz himself was among those affected. The refusal left one of the most obvious questions unanswered and underlined a pattern in the whole story: officials confirmed the warnings were real and serious, but said little about who exactly had been targeted. Documentary filmmaker Radwan Mortada was also among the recipients, according to the reporting, a reminder that the alerts reached beyond politics into journalism and film.

3. What mercenary spyware is and how it works

3.1 Costly tools sold mainly to governments

Mercenary spyware is the term Apple uses for sophisticated surveillance software that is built and sold commercially, usually to government customers, and used to target a small number of people. The tools are expensive, often costing far more than ordinary malware, and they are designed to get into a phone quietly and stay hidden while they collect messages, calls, photos and location data.

Because the software is sold rather than built by the attacker, the same product can in principle be used by different customers in different countries, which is one reason attribution is so difficult. Apple does not link its alerts to any particular group or geography, and neither Apple nor the German authorities have named who may be behind this round. No attacker, vendor or method has been identified in the reporting reviewed for this story.

3.2 Why these attacks are hard to see and hard to prove

A threat notification is not proof that a phone was infected. Apple describes its alerts as high-confidence signs that a specific person was deliberately targeted, while noting that its investigations can never achieve absolute certainty. The BSI made the same point in its own way, saying the notice does not show whether an attack succeeded. That gap between targeting and infection is the hardest part of the story to report accurately, and the easiest to misunderstand.

The difficulty cuts both ways. A person who receives an alert cannot be sure what, if anything, was taken from their phone, and investigators cannot easily reconstruct an attack from a notification alone. No patched iOS version, CVE number or exploited vulnerability has been tied to this wave in the reporting reviewed, which means this is a targeted-spyware story, not a confirmed, named zero-day. The absence of a technical fingerprint is itself part of the picture.

4. How Apple’s threat notification system works

4.1 High-confidence alerts since 2021

Apple has sent threat notifications since 2021 to people it believes may have been individually targeted by mercenary spyware, likely because of who they are or what they do. The company’s support page on the subject, published on August 13, 2026, describes the alerts as warnings for users who may have been singled out, and says the attacks have often been aimed at journalists, activists, politicians and diplomats. Reporting on this wave also mentions public officials and a documentary filmmaker.

The programme has now reached users in more than 150 countries in total, according to the alert text shared in this round. That total has grown wave by wave: 110 countries in the August round, 99 in the October round. The steady accumulation shows that the targeting is not confined to one region or one kind of victim, and that Apple’s notification system has become one of the few public windows into an otherwise secretive trade.

4.2 What the alert does and does not say

The alert tells a recipient that Apple has detected activity consistent with a mercenary spyware attack aimed at them personally. It does not say who is behind the attack, which spyware was used, or whether the attempt succeeded. It advises the recipient to take the warning seriously and to seek expert assistance, and it points them to Apple’s support guidance on protecting against mercenary spyware.

That restraint is deliberate. Apple does not disclose who may be behind the attacks or confirm whether a device has been compromised, according to the reporting. The company also does not publish a list of the countries in a given round. The result is a warning that is clear about the risk and silent about the culprit, which is why governments and researchers have had to fill in the gaps with their own investigations.

5. What recipients are being told to do now

5.1 The German advice: assume the device may be compromised

The BSI’s advice to recipients was blunt. According to a letter cited by public broadcaster ARD, the agency told Bundestag members and government officials to assume their devices were no longer secure. The instruction was not a confirmation that the phones had been breached; it was a precaution, telling people to act as if the worst had happened until experts could check.

The advice reflects how seriously German officials took the warnings. The BSI said it had no information on who was behind the notifications or what prompted them, yet it still issued an urgent warning over the weekend after the alerts began. The German government said it was working flat out to investigate the circumstances, and the digital minister’s public confirmation turned a private warning into a matter of public record.

5.2 Lockdown Mode, updates and expert help

The practical guidance for recipients is familiar but worth repeating. Reporting on the wave says the BSI advised recipients to update iOS and to consider Lockdown Mode, the optional iPhone setting that sharply restricts features most often exploited in targeted attacks. Keeping the operating system current closes known holes, and Lockdown Mode reduces the surface an attacker can reach.

Apple advises recipients of its threat notifications to seek expert assistance, and security researchers who track this field say that is the right advice: a targeted person needs a specialist to examine the device rather than relying on a factory reset or a software update alone. For people who did not receive an alert, the guidance is simpler. The news does not mean their iPhone is infected, and the ordinary steps — updating promptly and being careful with links and attachments — remain the best defence.

6. The wider fight over commercial spyware

6.1 The Pall Mall Process and the November deadline

The alerts arrived as governments were already negotiating rules for the commercial spyware trade. The Pall Mall Process, a voluntary effort launched by the United Kingdom and France in 2024, aims to curb abuse of commercial spyware, and 27 states are now close to a voluntary industry code for the sector. Civil society groups expect the industry guidelines to be completed in November 2026.

The process began with standards for governments and is now being extended to the vendors that build and sell the tools. That extension is the hard part: it asks companies that profit from surveillance software to accept limits on who they sell to and how their products are used. The November deadline gives the negotiations a fixed point, and the Apple alerts have added urgency to a debate that was already moving quickly.

6.2 Why the timing of this wave matters

The timing has not gone unnoticed. A Citizen Lab researcher noted that the attacks became public on the eve of a Pall Mall Process meeting in Paris on November 11 and 12, 2026, where voluntary industry guidelines for spyware use are to be unveiled. The observation does not prove a connection, but it frames the alerts as more than a technical event: they are also a piece of evidence in a live policy argument.

Whether the meeting produces a code with real teeth or a set of voluntary promises will shape how the industry is treated for years. The German case gives negotiators a concrete example to point to — elected officials warned that their phones may have been targeted — and it gives critics a reason to ask whether voluntary rules are enough. The answers will come from Paris, but the pressure now comes from Berlin as well.

7. What this means for ordinary iPhone users

7.1 No alert does not mean no risk, and an alert does not mean a hack

The most useful thing for ordinary iPhone users to take from this story is the distinction Apple itself draws. If you did not get one of these alerts, the news does not mean your iPhone is infected, because Apple sends these warnings only to people it believes were individually targeted. Mercenary spyware is aimed at a small number of people chosen for who they are or what they do, not sprayed across millions of phones.

The reverse is equally important. If a person did receive an alert, it does not prove their phone was hacked. It proves Apple has high confidence they were targeted. That is why the BSI told recipients to act as if their devices might be compromised while also being clear that the notice alone does not show whether an attack succeeded. Both halves of that message matter, and dropping either one distorts the story.

7.2 The habits that lower the risk for everyone

The defences against targeted spyware overlap heavily with good security habits in general. Updating iOS promptly matters, because Apple patches the flaws that attackers rely on, and the company has a record of rushing out fixes when a targeted attack is discovered. Using Lockdown Mode is a stronger step, designed for people who believe they may be targeted, and it trades some convenience for a much smaller attack surface.

Beyond the phone itself, the habits are unglamorous: treat unexpected links and attachments with suspicion, keep separate devices for sensitive work where possible, and know who to call if a warning ever arrives. None of these steps guarantees safety against a determined, well-funded attacker, and no honest account should claim otherwise. But together they raise the cost of an attack, and raising the cost is the practical goal when the attacker is choosing targets one by one.

8. What remains unconfirmed and what to watch next

8.1 The questions nobody has answered yet

Several central questions remain open. Nobody has said who is behind this campaign, and neither Apple nor the German authorities have named a suspect, a vendor or a country. Nobody has said how many people received alerts in this round, or published the list of the 99 countries. And nobody has tied a specific vulnerability, iOS version or CVE to the wave, so the technical route into the phones, if any succeeded, is still unknown.

In Germany, the open questions are more personal. It is not confirmed whether Chancellor Merz was among those alerted, how many Bundestag members received warnings, or what the investigation has found so far. The BSI said it had no information on who was behind the notifications, and the government has said it is investigating, but no findings have been published. Until those answers appear, the story rests on the alerts themselves and on the official advice that followed them.

8.2 What to watch next

The first thing to watch is the Pall Mall Process meeting in Paris on November 11 and 12, and whether the industry guidelines expected in November 2026 are actually published and what they contain. A code that names vendors, sets out due-diligence duties and creates consequences for abuse would be a real change; a vague statement of principles would not.

The second is the German investigation, and whether Berlin publishes findings, names a suspect or announces new protections for officials’ devices. The third is Apple’s next move: whether the company issues a fuller statement about this wave, and whether another round of alerts follows. Each of those developments will add a piece to a picture that is still incomplete, and each will be judged against the same test — whether it makes targeted people safer or only better warned.

The Apple spyware alerts reached users in 99 countries, warned German lawmakers to treat their phones as possibly compromised, and landed days before governments meet in Paris to write rules for the trade that produced them. What is known is serious enough: a fresh wave of targeting, a government investigation, and a negotiation with a deadline. What is unknown — who ordered it, how many were hit, and whether any phone was actually breached — will decide how the story is remembered. The coming weeks will provide the answers.

Comments

comments