German Government Issues High-Level Security Warning After Mercenary Spyware Targets Lawmakers and Public Figures

Berlin is facing a renewed cybersecurity crisis following official confirmations that prominent politicians, members of the Bundestag, and high-ranking public figures have been targeted by sophisticated, state-sponsored mercenary spyware. The alert comes directly on the heels of a massive global wave of threat notifications dispatched by Apple, which warned device owners across 99 countries that their iPhones may have been compromised by highly targeted cyberattacks.

The Federal Office for Information Security (BSI), Germany’s central cybersecurity agency, issued an urgent advisory over the weekend addressing the intrusions. According to the BSI, multiple members of Germany’s federal parliament, alongside other unnamed notable individuals within the country, received direct alerts from Apple indicating that they were the specific targets of state-backed mercenary operations.

The revelation has sent shockwaves through the German political establishment, prompting high-level discussions regarding operational security, mobile device vulnerabilities, and the escalating threat posed by the commercial surveillance industry. While government officials have scrambled to assess the scope of the breach, the incident underscores the pervasive nature of modern digital espionage and the growing challenge governments face in protecting their leadership from invisible, zero-click cyber weapons.

Immediate Government Response and Official Stance

Addressing the media in Berlin, German government spokesperson Stefan Kornelius confirmed that the administration was treating the security alerts with the utmost gravity.

"The federal government is taking the incident and the warning very seriously," Kornelius stated during a press briefing, reflecting the administration’s profound concern over the potential compromise of state-level communications.

Despite the gravity of the situation, the government has remained tight-lipped regarding specific identities due to ongoing security assessments and operational secrecy. When pressed by journalists, Kornelius declined to comment on whether high-ranking officials, including German Chancellor Friedrich Merz, were among those targeted by the cyberattacks.

The BSI, however, has adopted an aggressive posture regarding the credibility of the notifications. Because Apple’s automated threat detection systems do not explicitly confirm whether a device has been successfully penetrated—nor do they attribute attacks to specific nation-states due to the complex, obfuscated nature of mercenary cyber-arms—the BSI has instructed all recipients to operate under the assumption that their devices are entirely compromised.

In its advisory note, the BSI emphasized that ignoring an Apple threat notification is a critical security risk. Victims have been advised to immediately cease using affected devices for sensitive communications, report the incidents to designated parliamentary and federal IT security teams, and follow strict device isolation and forensic protocols.

The Global Scope: A Worldwide Wave of Cyber Intrusions

The attacks targeting German lawmakers are not isolated incidents; rather, they form a tiny fraction of a massive, coordinated global surveillance campaign. According to internal details provided by Apple in its recent round of threat alerts, users spanning 99 countries have received notifications warning them of state-sponsored mercenary intrusions.

The scale of this deployment highlights the widespread availability and aggressive utilization of commercial surveillance tools by various state actors across the globe. Among those who stepped forward publicly to confirm receiving the notifications was Radwan Mortada, an investigative filmmaker based in Beirut, Lebanon. Mortada shared screenshots and details on the social media platform X, revealing that Apple had warned him of "another attack against your device." For Mortada, the notification represents a continuation of targeted harassment, following a prior spyware attack that targeted his infrastructure in 2021.

Cybersecurity researchers note that these multi-country campaigns typically surge around periods of geopolitical tension, elections, or heightened investigative journalism. The deployment of such advanced tooling against targets across disparate geographical regions—ranging from European parliamentarians to Middle Eastern journalists—demonstrates that the market for offensive cyber capabilities remains robust, despite years of regulatory scrutiny and public outcry.

Understanding Mercenary Spyware and Zero-Click Exploits

To fully comprehend the gravity of the BSI’s warnings, one must examine the nature of the technology being deployed against these high-profile targets. Unlike traditional malware, which often requires user interaction—such as clicking a malicious phishing link or downloading an unauthorized attachment—modern mercenary spyware frequently relies on "zero-click" exploits.

Zero-click vulnerabilities allow attackers to infiltrate a device entirely invisibly. These exploits target underlying code flaws in standard software applications, such as messaging platforms, media renderers, or web browsers. By sending a specially crafted, invisible data packet to a device, the attacker can execute arbitrary code, bypass security sandboxes, and take full control of the operating system without the victim ever receiving a notification, seeing a missed call, or interacting with a prompt.

Once installed, mercenary spyware grants operators comprehensive access to the victim’s digital life. This includes real-time location tracking, ambient audio recording via device microphones, remote activation of cameras, extraction of encrypted messaging application data, and the harvesting of emails, contacts, and browsing history. Because modern smartphones serve as portable hubs for both personal and professional communications, a successful compromise of a lawmaker’s device can expose classified government documents, confidential political strategies, and private personal data.

The Murky Business of Commercial Surveillance Vendors

The proliferation of these cyber weapons sheds light on the controversial and opaque industry of commercial spyware vendors, often referred to in the cybersecurity community as "lawful interception" or "mercenary spyware" companies.

Historically, developing sophisticated zero-day exploits—software flaws unknown to the original vendor—was the exclusive domain of major nation-state intelligence agencies with massive research and development budgets, such as the United States, Russia, China, and Israel. However, over the past two decades, a lucrative private market has emerged. Private corporations now design, package, and sell turn-key offensive cyber arsenals exclusively to government clients.

The most prominent and controversial player in this ecosystem is the NSO Group, an Israeli cyber-intelligence firm known for developing the Pegasus spyware. Pegasus has been repeatedly implicated in high-profile espionage campaigns targeting human rights activists, journalists, dissidents, and politicians worldwide.

The involvement of private vendors creates a complex attribution and accountability dilemma. Governments that purchase these capabilities can theoretically maintain plausible deniability, as the attacks are technically launched through third-party infrastructure and proprietary exploits rather than direct military or intelligence command-and-control servers. Furthermore, because these tools are commercial products, their regulatory oversight remains weak, allowing authoritarian regimes and democratic nations alike to acquire offensive cyber capabilities with minimal international friction.

Ironically, government involvement in this market is not limited to utilization as a target. Investigative reports from organizations like Deutsche Welle have previously revealed that Germany’s own federal law enforcement agency, the Federal Criminal Police Office (BKA), secretly purchased access to the NSO Group’s Pegasus spyware in 2019 for domestic investigative purposes. This duality—where democratic governments attempt to regulate or condemn the use of spyware while simultaneously purchasing and deploying similar technologies—illustrates the deep hypocrisy and policy contradictions governing the international cybersecurity landscape.

Chronology of the Current Crisis

• 2019: Reports emerge indicating that Germany’s BKA secretly acquired access to NSO Group’s Pegasus spyware for law enforcement applications.
• 2021: Prominent figures, including journalists like Radwan Mortada, face targeted spyware campaigns utilizing advanced mobile exploits. Apple begins rolling out formalized "threat notifications" to alert suspected victims.
• Late 2025 – Early 2026: Security researchers, including teams at Citizen Lab and major tech firms, document a rising trend of threat actors abusing online advertising networks and zero-click delivery mechanisms to deploy mercenary spyware.
• The Weekend Prior to the Announcement: Apple dispatches a new, massive wave of threat notifications to users across 99 countries, warning individuals of state-sponsored mercenary attacks.
• Early Week: Germany’s BSI issues an official advisory note confirming that members of the Bundestag and other notable public figures have received Apple’s warnings, prompting a high-level response from government spokesperson Stefan Kornelius.

Broader Implications for National Security and Digital Sovereignty

The targeting of German lawmakers represents a critical escalation in the intersection of national security and consumer technology. As nation-states increasingly rely on commercial off-the-shelf spyware to conduct espionage, the attack surface expands far beyond traditional military networks and secure government servers, reaching directly into the consumer devices carried by elected officials.

This trend poses profound questions regarding digital sovereignty. When foreign or domestic intelligence agencies can bypass the security architectures of major consumer operating systems like iOS to spy on parliamentarians, the fundamental trust in digital infrastructure is shaken. It forces governments to re-evaluate their mobile device policies, with some agencies moving toward strict device segregation, banning smartphones from sensitive briefing rooms, or developing ultra-secure, hardened operating systems for official use.

Moreover, the ongoing friction between tech giants like Apple and the spyware industry highlights an ongoing technological arms race. While Apple continues to patch vulnerabilities, introduce advanced security features like Lockdown Mode, and issue proactive threat notifications, mercenary spyware developers continuously engineer novel workarounds to maintain access to high-value targets.

As investigations into the latest wave of attacks continue, the BSI and international cybersecurity partners are expected to release further technical indicators of compromise. However, until stricter international regulations are enforced against the commercial proliferation of offensive cyber weapons, politicians, journalists, and civil society members will likely remain in the crosshairs of an invisible, high-stakes digital war.