The German Federal Office for Information Security (BSI) has issued a notice explaining that several members of the nation’s Bundestag have received warnings from Apple that they might be the target of mercenary or nation-state spyware attacks.
The BSI said that it “is not aware of whether these notifications mean actual compromises or merely indicate attempts at attack.” The campaign has not been linked to any specific threat group or nation, but the BSI added that many instances of mercenary spyware can operate using “zero click” techniques that can infect a victim’s device without them noticing.
Because of that, the BSI stated that “Those affected who received an appropriate alert from Apple should therefore assume that their device may have been compromised.” The BSI sent a letter to affected individuals on Oct. 30, informing them about what they can do to protect themselves.
BSI says to verify the alert, then lock down the phone
If you have received a message purporting to be a spyware attack warning from Apple, the first recommendation from the BSI is to first confirm that the message is genuine. A real message from Apple will appear on your iPhone Lock Screen and at the top of the iOS Settings app. Apple won’t ask you to click links, open files, enter verification codes and passwords or install apps.
Once you’ve confirmed the warning’s provenance, the BSI advised users to update their iPhone’s operating system. Users can also consider enabling Lockdown Mode. This setting severely restricts certain iPhone features, including Messages, web browsing, FaceTime and device connections.
If the situation is serious enough, the BSI said users should consider replacing affected devices, possibly changing their phone numbers and resetting all accounts connected with their phones. Passwords for all linked accounts should be updated and two-factor authentication (2FA) should be enabled.
The BSI stated that mercenary spyware is “commercially developed spying software that has often been used in the past on behalf of government agencies against individual, specifically selected persons.” It cited the NSO Group’s Pegasus spyware as a particularly prominent example.
The Bundestag incident is far from the only case of mercenary spyware that has surfaced in recent months. On Oct. 15, Citizen Lab detailed a sophisticated campaign that delivered zero-click mercenary spyware via targeted online ads.
