Apple Spyware Warnings Hit German Lawmakers: How to Tell If You're a Target and Lock Down Your iPhone

Apple's threat notifications are the kind of message that makes your stomach drop. You open your iPhone, see a banner that says Apple believes you are being targeted by a state-sponsored attacker, and you have no idea whether it is real, what happened, or what to do next. In April 2024, that exact message went out to a number of German lawmakers and other political figures, and it reignited a conversation many security teams have been having quietly for years: mercenary spyware is no longer only a problem for journalists in Pegasus-style headlines. It reaches politicians, lawyers, activists, and executives, and it reaches them through devices they trust.

Apple's notifications are sent to users it has reason to believe were targeted by "mercenary" attacks, a term the company uses for commercial surveillance tools sold to governments and private contractors. Apple does not publish the full list of recipients, does not name the attacker in every case, and does not always know how the device was compromised. That leaves a lot of people asking the same practical questions: Is this a false alarm? Did I get hacked? Should I wipe my phone? And what can I do today to make my iPhone harder to compromise in the first place?

This article answers those questions in order. We will cover what the warning actually means, how to tell whether your device shows signs of compromise, the immediate steps to take if you believe you were targeted, and the hardening settings worth turning on whether or not you have ever seen a warning. Along the way we will compare the options for getting an independent second opinion, and we will be honest about where the protections end. Nothing here replaces a formal investigation if you are at serious risk, but for most readers, a disciplined afternoon with the right settings goes a long way.

Key Takeaways

• An Apple threat notification means Apple has high confidence a state-linked or mercenary attacker targeted your Apple ID or device. Treat it as real, but do not panic-wipe before preserving evidence.
• Update iOS to the latest version immediately, enable Lockdown Mode if you are at elevated risk, and turn on Advanced Data Protection for iCloud.
• Check for unknown configuration profiles, unfamiliar devices signed into your Apple ID, and unexplained battery drain or data usage spikes.
• Change your Apple ID password and the passwords for email and any accounts linked to it, using a unique password for each, stored in a password manager.
• If you are a journalist, activist, lawyer, or public official, consider a professional forensic check through a recognized digital rights organization before you wipe anything.
• Assume no single setting makes you invulnerable. Layered habits, meaning updates, limited installs, and skepticism about links, do most of the real work.

What an Apple Spyware Warning Actually Means

An Apple threat notification is a targeted alert, not a general security advisory. Apple sends it to users whose Apple ID or device shows signs that they were the specific target of a sophisticated attack. The notification appears as a banner or an alert in the Apple ID section of Settings, and it usually includes a line saying you should take it seriously.

Apple distinguishes these notifications from routine malware. Commodity malware is spread broadly, often through phishing emails or fake app stores, and it aims for money or credentials at scale. Mercenary spyware, in Apple's framing, is built and sold to be deployed against chosen individuals, often with zero-click or near-zero-click exploits that require no action from the victim.

What Apple does and does not tell you

• Apple confirms that it detected a pattern consistent with a targeted attack against your account or device.
• Apple usually does not say which attacker is responsible, which exploit was used, or what data was accessed.
• Apple does not scan your phone and report back a clean bill of health in every case, and it does not guarantee that a notification means you are infected right now.
• Apple's notifications have been sent to a broad range of recipients in multiple countries, including the German lawmakers reported in 2024, so the warning is not limited to a single region or profession.

The practical takeaway: a notification is strong evidence of targeting and a reason to act, but it is not a diagnosis. You need to check your device yourself and, ideally, have it examined by someone equipped to find the traces that spyware leaves behind.

How to Tell If Your iPhone Is Being Targeted

Mercenary spyware is designed to be quiet. Many of the classic symptoms people look for, such as a hot phone or a dead battery by lunch, are real but unreliable. A phone can overheat for dozens of mundane reasons, and a battery can drain from a weak cell signal or a background app. The useful signs are the ones that point to something unauthorized.

Signs worth investigating

• Unknown configuration profiles. Go to Settings, then General, then VPN and Device Management. If you see a profile you did not install, that is a serious red flag. Spyware sometimes installs profiles to gain persistence or redirect traffic.
• Unfamiliar devices on your Apple ID. Check Settings, tap your name, and scroll down. Any device you do not recognize, especially a Mac or iPad you never owned, deserves attention.
• Unexplained data usage. Check Settings, then Mobile Service (or Cellular), and look at usage per app over the last month. A spike in an app you rarely open, or in system services, is worth a closer look.
• Unexpected restarts or a device that fails to shut down properly. Occasional reboots happen, but repeated unexplained restarts are not normal.
• Apps you did not install. Scroll your home screen and App Library. Hidden or oddly named apps are a concern.
• Your accounts behaving strangely. Login alerts, password reset emails you did not request, and two-factor prompts you did not trigger are often more telling than anything on the phone itself.

Signs that are weaker evidence

• A warm phone while charging or during a video call.
• A battery that drains faster after an iOS update, which often settles within a few days as the system re-indexes.
• Slow performance on an old device.

Treat these as context, not proof. Many people who worry about spyware are actually dealing with ordinary wear, and many people who have been compromised notice nothing at all.

Immediate Steps If You Received an Apple Threat Notification

The instinct after a scary notification is to wipe the phone and move on. That instinct can destroy the evidence you or a forensic specialist would need to understand what happened. The steps below are ordered to protect you first and preserve information second.

A numbered walkthrough

1. Do not ignore it and do not tap any links in the notification or in any messages that follow. Attackers sometimes send follow-up phishing messages that impersonate Apple support.
2. Update iOS to the latest version right away. Go to Settings, General, Software Update, and install what is available. Apple often patches the exact vulnerabilities used in these campaigns. If you cannot update, note the version you are on.
3. Take screenshots and record details before changing anything. Capture the notification itself, the date and time, the iOS version, and the list of profiles and devices you saw in steps above. Store copies somewhere off the phone.
4. Remove any unknown configuration profiles. Only after screenshotting them, go to Settings, General, VPN and Device Management, select the profile, and delete it. Be aware that removing a profile may itself be a clue for an investigator, which is why step 3 comes first.
5. Sign out of unfamiliar devices and change your Apple ID password. Use a new, unique password generated by a password manager. Then enable or confirm two-factor authentication on your Apple ID.
6. Change passwords on accounts tied to your phone. Start with email, since email resets control everything else. Then move to banking, cloud storage, messaging, and social accounts. Use a different password for each, stored in a password manager.
7. Turn on the protections described in the next section. Advanced Data Protection and Lockdown Mode are the two most important.
8. Seek an independent examination if the stakes are high. If you are a journalist, activist, lawyer, public official, or someone in a dispute with a powerful party, contact a recognized digital rights organization for help before you wipe or restore the device.
9. Decide whether to restore or replace. A full erase and restore from a clean backup, or a move to a new device, is often the cleanest outcome. Restore from a backup made before the suspicious period, and verify that the backup is not itself compromised.

Hardening Your iPhone Before Anything Happens

Whether or not you have ever seen a warning, a few settings meaningfully raise the cost of a targeted attack. None of them are exotic. Most people never turn them on.

Settings worth enabling today

• Automatic iOS updates. Go to Settings, General, Software Update, Automatic Updates, and enable Install iOS Updates. Patching fast is the single highest-value habit.
• Advanced Data Protection. Found under your Apple ID, then iCloud, then Advanced Data Protection. It encrypts most iCloud data end to end, so even Apple cannot read it. Note that you should set up a recovery method first, because losing access can mean losing data.
• Lockdown Mode. Found under Settings, Privacy and Security, Lockdown Mode. It disables several features that spyware commonly abuses, including certain message attachment types, some web technologies, and wired connections while locked. It is inconvenient, and Apple recommends it only for people who face targeted threats. If you are in that group, the tradeoff is usually worth it.
• Two-factor authentication on your Apple ID with a hardware key, if you can. Security keys resist phishing far better than SMS codes.
• Stronger passcode. Use a six-digit code at minimum, or a full alphanumeric passcode for more protection. Avoid biometrics only where your threat model suggests an adversary could compel you to unlock.
• Reduce what your phone exposes. Turn off Bluetooth and AirDrop when not needed, set AirDrop to Contacts Only, and disable automatic joining of open Wi-Fi networks.

Worked example: a small hardening session

Say you manage 47 passwords across 12 services, your phone is your primary device for work email, and you are a freelance reporter who occasionally covers sensitive stories. Here is a realistic afternoon.

First, you update iOS and turn on automatic updates, which takes ten minutes. Second, you enable Advanced Data Protection after setting a recovery contact and saving a recovery key in a password manager, about twenty minutes. Third, you audit your password manager and find that 19 of your 47 passwords are reused or weak. You generate new unique passwords for the 19 most important accounts, starting with email, banking, and cloud storage. That takes most of an hour. Fourth, you turn on Lockdown Mode for a week to see how it feels, and decide whether to keep it on during high-risk assignments. Finally, you review your

Cover image: Innovate Maryland Emerging Technology Center by MDGovpics, licensed under BY 2.0 via Openverse.