Germany investigates a possible cyberattack directed against the mobile phones of Bundestag deputies and members of the federal Government after Apple sent several security warnings over attempts to infect them with spyware programs. The German Minister for Digitalization, Karsten Wildberger, has confirmed that different political officials have received notifications about a possible breach of their devices through spyware, a tool capable of accessing private communications, personal information and even activating the cameras and microphones of phones without the knowledge of their owners.
The first alerts began to arrive on October 29, according to a communication from Germany's Federal Office for Information Security (BSI) that the public broadcaster ARD has had access to. The agency has contacted the affected people and has recommended considering their phones potentially compromised as a precautionary measure, although it has still not been confirmed that the attackers managed to install the spyware or extract information from the devices. Nor is it known how many deputies and members of the Executive have received the warnings or who could be behind the operation.
Apple detects attacks with spyware against German politicians
The Minister for Digitalization confirmed the situation during an interview given this Sunday to the program "Bericht aus Berlin" on the public broadcaster ARD. Wildberger explained that Apple had identified indications of an attack directed against certain devices and that the German cybersecurity authority had reacted quickly to inform those affected and establish the first protection measures.
The notifications refer to a possible attack with "mercenary spyware", a category of computer programs used to carry out especially sophisticated surveillance operations. Unlike conventional viruses, these tools are usually developed to attack specific people and can exploit security vulnerabilities unknown to their manufacturers.
According to the documentation released by the BSI, Apple’s warnings do not allow determining whether the infection attempt was successful, so the agency has asked those affected to act with the utmost caution. The investigation remains open and the German authorities have still not publicly identified those responsible.
The concern also extends to other people of public relevance who, according to German television ZDF, are among the recipients of the security alerts. However, the identity of none of the affected persons has been disclosed.
What information iPhone spyware can steal
The main risk of this type of attack lies in the ability of spyware to access especially sensitive information without the phone owner necessarily detecting its presence. According to the German Federal Office for Information Security, these tools can allow access to private messages, phone calls, contacts, calendars and geolocation data.
In addition, some advanced spyware can remotely activate the device’s microphone and camera, which would make it possible to listen to conversations or capture images without authorization. They can also access the content of encrypted messaging applications when they manage to take control of the phone itself, although this does not necessarily mean they have succeeded in breaching the encryption system of those platforms.
One of the best-known examples is Pegasus, developed by the Israeli company NSO Group, a program that has been at the center of different international controversies for its use against politicians, journalists and activists. However, there is no public evidence that Pegasus is the software used in the attack investigated in Germany, so that link cannot be established.
The German authorities consider especially worrying that some of these attacks can be carried out without the victim needing to click a link or voluntarily download a file. These are techniques that exploit security flaws in an attempt to introduce spyware directly onto the device.
Germany recommends changing phones for those affected by the attack
Given the possibility that the devices may have been compromised, the BSI has recommended that those who received the warnings take extraordinary security measures. According to information published by ZDF, the agency advises using a new phone and a new phone number, as well as transferring only the strictly necessary data and avoiding restoring a complete backup of the previous device.
These recommendations respond to the difficulty of determining to what extent an advanced spyware program can remain hidden on a phone. The absence of visible symptoms does not necessarily rule out an infection, so the authorities prioritize protecting the communications of the affected people while the investigations are being carried out.
For its part, Apple explains that its threat notifications are sent when it identifies solid indications that a person has been the target of a directed espionage attack. The company considers these to be operations much more complex than usual computer attacks, generally aimed at a small number of targets of political, diplomatic, or strategic interest.
How to know if Apple has detected an espionage attempt on your iPhone
Apple has a specific system to alert users who may have been selected as targets of this type of operation. The warnings appear on the iPhone lock screen, in the device settings, and via an email associated with the Apple account. In addition, the user can check whether there is an authentic notification by directly accessing account.apple.com.
The company warns that it never requests passwords, verification codes, or the installation of applications through these alerts, an important precaution to avoid possible impersonation attempts. Among the general protection measures, it recommends keeping the operating system updated, using two-factor authentication, and activating Lockdown Mode when there is a high risk of suffering a targeted attack.
In any case, Apple emphasizes that the vast majority of iPhone users will never be the target of espionage operations of this kind, which usually focus on specific profiles because of their activity or the information to which they have access.
The incident has reopened the debate about the protection of the communications of political officials and the vulnerability of the devices used to manage institutional information. For now, the German authorities are maintaining the investigations to determine the scope of the attack, identify its possible origin, and clarify whether any of the affected phones was compromised.