Zero-Click Spyware Reaches the Bundestag as Apple Warns Users in 99 Countries

A Zero-Click Knock on the Bundestag's Door

Since October 29, 2026, iPhones belonging to Bundestag members and other public figures in Germany have been lighting up with Apple threat notifications warning of an attack using so-called mercenary spyware. Digital minister Karsten Wildberger confirmed the alerts on ARD's "Bericht aus Berlin" on November 1 without saying how many politicians received them.

The suspected attacks reportedly relied on a "zero-click" vulnerability, meaning the owner never had to tap a link, open a file, or do anything at all. Spyware of this class can pull messages, location data, and pretty much anything else on the phone, so being careful with suspicious texts protects absolutely nothing here.

Germany's federal cybersecurity office, the BSI, told the people affected that they "should therefore assume that their device may have been compromised."

Government spokesperson Stefan Kornelius said Berlin is "taking the incident and the warning very seriously," but he wouldn't say which officials were targeted or whether Chancellor Friedrich Merz is among them. Naturally, the people whose phones may be leaking state business are the last ones the public gets to hear about.

99 Countries and Not a Single Name

Germany is far from alone in this wave. Apple's latest notifications reached users in 99 countries, a figure that comes from the notice received by Beirut-based filmmaker Radwan Mortada, whose phone Pegasus targeted in 2017 and 2021. Apple told him it had detected "another attack against your device," while Middle East Eye bureau chief Ragıp Soylu reported getting a warning too.

Apple has sent these alerts several times a year since 2021, reaching users in more than 150 countries in total. It never names who's behind an attack and never confirms whether a particular phone was actually compromised.

The governments on the buying side fare no better under scrutiny, with at least 18 EU member states linked to commercial spyware purchases and no government ever convicted for turning it on its own people.

So the only alarm that reliably goes off in this whole system belongs to a private company, and it switches off right before anyone gets named. I think that should be called what it is, an accountability vacuum where the most a target can expect is a polite notification and a suggestion to turn on Lockdown Mode.

Germany Already Knows Who Buys This Stuff

Mercenary spyware is sold to governments, with Israel's NSO Group and its Pegasus being the best-known example, and Germany knows the customer side well since its Federal Criminal Police Office, the BKA, reportedly bought access to Pegasus in 2019.

Nobody has named who is behind this latest attack, but when the usual buyers are governments and Berlin has been one of them, the pattern is consistent enough that the inference requires no real effort.

Meanwhile, NSO went back to targeting WhatsApp users just eight months after a US federal court permanently barred it from doing exactly that, which says plenty about how much a ruling scares this industry.

Germany is now alarmed by an industry its own police paid into, and I absolutely don't think Berlin gets to act surprised when tools of the kind it helped fund start showing up on its own parliament's phones.

And yet, the official response so far treats this as a hacking incident to investigate, with no word about the BKA's own purchase or any plan to stop buying from the vendors who make attacks like this possible.

So if the Merz government is really taking this "very seriously," it can tell the public what the BKA did with Pegasus and push for an EU-wide ban on buying mercenary spyware, before the next wave lands on a journalist or activist who has no cybersecurity agency writing them letters.