Apple Sent Spyware Threat Notifications to Users in 99 Countries; Germany Investigates

Originally published on Rohan Tech Official.

On October 30, Apple sent a fresh round of threat notifications to iPhone users it believes were targeted by state-sponsored spyware — across 99 countries. Now Germany is investigating, and its officials have been told to assume their devices may already be compromised. If you've ever wondered what a real government-grade hacking scare looks like, this is it.

Security researcher Costin Raiu shared the notice text publicly, confirming the scope. Here's what we know — and what you should do.

What Apple Sent on October 30

Apple's threat notifications aren't marketing emails. They're reserved for cases where the company has high confidence that a user was individually targeted by mercenary or state-backed spyware. The October 30 round went to users in 99 countries, making it one of the widest such waves Apple has ever sent.

The notices warn recipients that attackers may have tried to compromise their iPhones remotely. Apple doesn't name the attackers — it rarely can with certainty — but the "state-sponsored" framing points at the same shadowy market of commercial spyware vendors that has fueled scandals for years. You can read how Apple describes these alerts on its official threat notification support page.

Why 99 Countries Matters

The country count is the story. Past notification rounds covered dozens of countries; 99 suggests a campaign of unusual breadth — or better detection. Either way, it means this isn't a single government's operation against a handful of dissidents. The targeting appears global, hitting journalists, activists, officials, and other high-value targets across nearly a hundred nations.

That breadth raises uncomfortable questions. How long was the campaign running before Apple caught it? How many targets never got a notification? Apple only alerts users it's confident about, so the true number of victims is likely higher.

Germany's Response

Germany moved fast. The country's federal cybersecurity agency, the BSI, warned members of the Bundestag and government officials to assume their devices may be compromised. Digital Minister Karsten Wildberger confirmed the warnings publicly, and German authorities opened an investigation into the campaign.

This is the kind of response that signals seriousness. Governments don't tell their own parliamentarians to treat their phones as hostile unless the intelligence behind it is convincing. Germany's federal security office (BSI) doesn't issue such guidance lightly — it's the same agency that sets security standards for the country's critical infrastructure.

The Zero-Click Question

According to the Financial Times, investigators suspect the exploitation of a zero-click vulnerability — a flaw that lets attackers compromise a phone without the victim tapping a link, opening a message, or doing anything at all. Zero-clicks are the gold standard of spyware: invisible, silent, and extremely expensive to develop.

The attacker remains unidentified, though it's believed to be state-backed. That's the pattern with commercial spyware — vendors sell to governments, governments deploy against targets, and attribution stays murky by design. Similar to the SMS of Death flaw we covered earlier, the scariest vulnerabilities are the ones that need no user interaction.

What Should You Do?

First: most readers were not targeted. These notifications go to a tiny fraction of users. But the episode is a reminder of good habits that protect everyone:

• Update immediately. Keep iOS on the latest version — patches close the holes these campaigns use.
• Enable Lockdown Mode if you're in a higher-risk role (journalist, activist, official). It's Apple's hardest security setting.
• Restart your phone regularly. Many sophisticated implants don't survive a reboot.
• Watch for the real thing. Apple's notifications arrive via email and iMessage from Apple, and appear at the top of appleid.apple.com when you sign in. Phishing copies exist — verify through Apple's site directly.

The Bigger Pattern

This isn't an isolated incident — it's the latest chapter in a long-running spyware crisis. From the Denmark data breach to the commercial spyware industry's endless scandals, the trend is clear: targeted hacking is industrializing, and the targets keep expanding.

Apple says it sends these alerts only when it has high confidence in the targeting assessment. That restraint is exactly why each round lands with such weight — when Apple speaks, the security world listens.

Ninety-nine countries. Government officials told to assume compromise. An investigation underway in Berlin. Whatever comes out of Germany's probe, this story isn't over — and the next round of notifications may already be on its way.