Apple sent threat alerts to targeted Iranian iPhone users about spyware attacks, urging swift action and system updates.
Security researchers have reported that Apple has informed over a dozen Iranians in recent months that their iPhones have been infected with government spyware.
According to Miian Group, a digital rights organization that concentrates on Iran, and Hamid Kashfi, an Iranian cybersecurity researcher residing in Sweden, they have interviewed numerous Iranians who received the notifications within the past year.
Bloomberg was the first to report on these adware notifications.
On Tuesday, Miaan Group released a report regarding the cybersecurity of civil society in Iran. The report indicates that the organization’s researchers have identified three instances of government espionage attacks against Iranians, two of which occurred in Iran and one in Europe. The victims were notified in April of this year.
“Two individuals in Iran are members of a family with a long history of political activism against the Islamic Republic.” “Amir Rashidi, the director of digital rights and security at Miaan Group, stated to TechCrunch that numerous members of their family have been executed and they have no history of traveling abroad.”
“I think there have been three waves of attacks, and we have only observed the tip of the iceberg.”
Rashidi stated that it is probable that Iran is responsible for the attacks, although additional investigations are necessary to make a more definitive determination. “I do not perceive any justification for individuals in civil society to be targeted by any entity other than Iran,” he stated.
In a recent email, Kashfi, the founder of the security firm DarkCell, stated that he assisted two victims in completing preliminary forensics procedures. However, he could not identify the spyware manufacturer responsible for the attacks.
Additionally, he said that some victims with whom he collaborated preferred not to continue the investigation.
“Almost all of the victims were startled and abandoned us as soon as we disclosed the gravity of the situation.” “I assume that the sensitivity of the matters related to their place of employment is a contributing factor,” Kashfi stated. He also mentioned that one of the victims received the notification in 2024.
The identity of the spyware manufacturer responsible for these assaults remains uncertain.
In recent years, Apple has sent numerous notifications to individuals the company suspects have been the target of government spyware, including Pegasus from NSO Group and Graphite from Paragon. This type of malware is also called “mercenary” or “commercial” spyware.
The notifications have facilitated the documentation of abuses in numerous countries, including India, El Salvador, and Thailand, by security researchers specializing in spyware.
Apple’s support page for “threat notifications,” last updated in April, indicates that the company has notified users in “over 150 countries” since 2021. This demonstrates the extent to which government surveillance is being used. Apple does not disclose the names of the countries or the total number of individuals it has notified.
Since last year, Apple has advised recipients of these threat notifications to contact the digital rights organization AccessNow, a 24/7 helpline staffed by researchers capable of investigating spyware attacks. This is to assist victims. AccessNow has documented instances of spyware exploitation worldwide.
Apple did not respond to a request for comment regarding the notifications sent to Iranians.
