Apple Spyware Alerts: What iPhone Users Should Do
Apple spyware alerts reached targets in 99 countries. Learn what the warning means, what Germany’s BSI recommends and how to respond safely.
Apple's Spyware Warning Is Not Proof of Infection. It Is a Reason to Act
An Apple threat notification isn't a generic security prompt. It indicates the company believes a specific person may have been targeted by spyware - often the kind of attack built for one individual, not a mass problem that hits lots of iPhone users. What it does not do is prove that the attacker successfully broke into the device.
That distinction matters. Germany's Federal Office for Information Security (BSI) has told lawmakers who received recent Apple warnings to assume their devices might have been compromised. The alerts started reaching public figures on 29 October. Apple said the notification round covered targeted users in 99 countries. The BSI also said it can't determine, based on the alert alone, whether an attack actually succeeded or was only attempted.
If you receive a similar warning, your next steps should depend on your risk level - and whether you need investigators to look at the phone. Here's what Apple's alert can and can't tell you, what the BSI recommends, how to reduce exposure without wiping out useful evidence, and why encrypted messaging apps aren't a complete safeguard if spyware is already on the device.
Key takeaways: Take the notification seriously, but don't treat it as confirmation that you're infected. If a forensic review could matter, talk to an incident-response specialist before changing anything on the device. If not, update iOS, enable Lockdown Mode, and secure your accounts using a trusted device.
What does an Apple spyware alert mean?
Apple describes its threat notifications as high-confidence warnings: it has detected activity consistent with a targeted spyware attack. That's important, but it's not the same thing as a forensic finding that spyware is actively running on your iPhone. Apple doesn't name the suspected attacker or identify the actor behind a specific alert, and the notification doesn't include enough detail to confirm whether an intrusion actually succeeded.
The BSI made that uncertainty plain after several Bundestag members and other public figures received warnings. It said it didn't know whether their phones had been compromised or were only targeted. Its advice was still to assume compromise is possible - because risk management is about planning for the worst plausible case, not declaring certainty.
Why does Apple send these notifications?
Apple has been sending threat notifications several times a year since 2021. Based on its support information, those alerts have reached users in more than 150 countries. The most recent round - flagged by threat researcher Costin Raiu on 30 October - was reported to involve targeted users in 99 countries and to be separate from an August wave.
The goal is to warn people who may face unusually targeted attacks, not to serve as a general "your iPhone is vulnerable" message. Recipients could include journalists, elected officials, activists, or others who may be of interest to attackers. Getting one doesn't mean you did anything wrong; it means Apple believes your account or device may have been singled out.
What the alert cannot tell you
A notification isn't a full incident report. It doesn't identify the operator, confirm the attacker's motive, or prove that any data was accessed. Raiu told The Record that researchers hadn't seen log signs in the materials they reviewed that would confirm which actor was behind the activity. Even if those signs aren't present in what's available, that still isn't proof that nothing happened - sometimes it's just a limit of what can be verified.
Treat the alert as a reason to take a careful, deliberate approach. Don't dismiss it just because the phone "seems normal," but also don't publicly accuse a specific government or company without evidence. If you're a high-risk recipient, one of the first questions is whether you should preserve the phone for analysis - or focus on reducing the chance of further access.
What should you do after receiving the warning?
Start by deciding whether the device may need forensic examination. Updating the phone, resetting it, or replacing it could change or erase evidence investigators might need later. The BSI's guidance reflects this: if the recipient doesn't plan to have the device examined, it recommends installing the latest software promptly. If you're a journalist, a public official, or someone handling sensitive sources, talk to your security team or a qualified incident-response specialist before making changes.
If you're not planning an investigation, act quickly - but still methodically. Write down when the alert arrived, save a screenshot, and note any relevant device or account activity. Avoid using that phone for sensitive conversations while you figure out what to do next. Then contact the relevant national cybersecurity authority - or your organization's security contact - using a separate, trusted device.
Apply the BSI's core safeguards
For people who aren't preserving the device for analysis, the BSI recommends:
- Update the phone's software immediately. Install available iOS security updates rather than waiting. Updates address known weaknesses, but they can't tell you whether a past attack worked.
- Turn on Apple Lockdown Mode and keep it enabled. The BSI recommends using it even on a replacement device if the risk remains elevated. It restricts certain features and makes some attack paths harder.
- Consider a new phone if your risk is high. Swapping hardware may be appropriate when the threat is sustained or sophisticated - but it won't fully solve the problem if the same accounts and credentials remain exposed.
- Reset accounts and change credentials. The BSI recommends resetting every account used on the phone, setting a new passcode, changing passwords, enabling two-factor authentication, and issuing fresh PINs for Signal and WhatsApp.
- Consider changing your phone number. The agency includes this for people who judge their risk to be high. It's disruptive, so weigh it against your threat model and get expert advice when possible.
Secure accounts from a trusted device
If you think the phone may be compromised, use a different, trusted device to change passwords and review account sessions. Start with email and your Apple Account, because losing control of either can let an attacker regain access elsewhere. Sign out unknown sessions, review recovery options, and use unique passwords. Don't assume that changing a password on the potentially compromised phone is enough - spyware may capture what you type.
Keep a record of what you changed and when. For individuals, it becomes a straightforward recovery checklist. For a newsroom or government office, it helps the security team track which accounts, numbers, and devices might be involved. Lockdown Mode can reduce future exposure, but the BSI warns that it doesn't remove an infection that may already be present.
Why is mercenary spyware a serious iPhone risk?
Mercenary spyware is surveillance software built for sale or distribution to customers, including state actors. Instead of spreading indiscriminately like typical malware, it's usually used against specific people. That changes the risk picture: the target's role - such as access to government decisions, confidential reporting, or sensitive sources - can matter more than it would for the average consumer.
Once spyware has access to a phone, it may be able to read messages, including those in encrypted apps, and activate the camera or microphone, according to the BSI. End-to-end encryption protects messages while they travel between devices, but it doesn't protect data from spyware that can view or capture it on an already compromised endpoint. That's why "I use encrypted messaging" isn't a complete security plan.
Zero-click attacks change the usual advice
Some known attacks have used zero-click techniques. Those can reach a device without the target tapping a link, opening an attachment, or taking another obvious step. Good habits still help, but "don't click suspicious links" can't prevent every targeted intrusion. It's one layer, not a guarantee.
The source material also notes that Citizen Lab reported in October that an Israeli advertising firm used online ads to spread Candiru spyware. That example shows how attackers can use a normal part of the internet as a delivery route. It doesn't prove the same method was used against the people Apple warned in the latest notifications.
What Lockdown Mode can - and cannot - do
Lockdown Mode is designed to reduce the attack surface by restricting certain capabilities. That can make some sophisticated attacks harder, which is why the BSI recommends it for people at elevated risk. The trade-off is that some features and communication experiences may be limited. For people who may be targeted, that inconvenience can be worth it. For most users, it may be unnecessary friction.
The key limitation is simple: Lockdown Mode isn't a malware-removal tool. If spyware is already on a phone, turning it on doesn't prove the problem is gone. A device that might be needed as evidence should be assessed before changes are made. If forensic review isn't needed, update and secure the device, and handle account recovery from a trusted endpoint.
What does this alert wave mean for public figures?
These notifications have landed amid broader reporting and repeated allegations about spyware targeting journalists and public officials. Turkish journalist Ragıp Soylu said the latest alert was his third this year and described ongoing attempts to hack his phone. Lebanese journalist and filmmaker Radwan Mortada said he received a warning after being targeted with Pegasus in 2017 and 2021. He also raised concerns about timing in relation to his investigative work, while saying he had no concrete evidence linking the events.
Those accounts should be treated as what the people involved report - not as independent proof of which actor caused the latest alerts. The difference matters in security reporting: timing can justify further investigation, but it doesn't establish attribution. Apple's notice itself doesn't name an attacker, and researchers interviewed by The Record said they hadn't found logs confirming responsibility.
Why journalists and institutions need a response plan
For a reporter, a compromised phone can expose sources, drafts, location data, and day-to-day communications with colleagues. For a lawmaker, it can put private discussions - or sensitive institutional information - at risk. And the harm isn't limited to the device owner. People who have communicated with that person may also be at risk, even if their own phones never received an Apple warning.
That's why organizations should define a process ahead of time. Decide who receives the alert, who can authorize forensic work, how to preserve a device, and how to contact affected colleagues without relying on the potentially compromised phone. A practical plan also clarifies when to involve legal, communications, or government security teams. Those decisions are hard to make calmly during an incident if nobody has ownership for them before anything happens.
Spyware is not only an iPhone issue
German federal police, the BKA, bought a version of Pegasus, according to reporting on a 2021 disclosure to the Bundestag's interior committee. Separately, a European lawmaker who investigated spyware abuse said attackers used Pegasus against him, and victims of Predator spyware in Greece are suing its maker for €8 million. Those cases don't prove a direct link to the current Apple alert wave, but they underline that spyware has been an active institutional and legal issue in Europe.
For users, the practical takeaway isn't to guess which product or which government is involved. The point is to preserve what you can verify, reduce avoidable exposure, and base decisions on credible technical assessment. Public attribution may take time - or it may never be fully confirmed. Either way, security action doesn't have to wait for a definitive press-ready explanation.
Conclusion: respond to the risk, not the headline
Apple's warning is a high-confidence signal of targeting, not a public forensic verdict. Germany's BSI is right to recommend a cautious posture: preserve the device if investigators may need to examine it; otherwise, update it, enable Lockdown Mode, and secure your accounts from a trusted device. What you do next depends on how exposed you are and what information could be at stake.
For individuals, the priority is to avoid both complacency and rushed fixes. For organizations, the priority is a response process that protects evidence, accounts, and everyone connected to the targeted person. Take the alert seriously, document what you do, and get qualified help when the consequences of a missed compromise are high.