Apple alerted Iranians to iPhone spyware attacks, say researchers

In recent months, Apple has alerted over a dozen Iranian users about attempts to compromise their iPhones using government spyware, as highlighted by security researchers. The Miian Group, a digital rights organization dedicated to advancing civil liberties in Iran, along with Hamid Kashfi, a cybersecurity expert based in Sweden, reported that they had engaged with several individuals who received these warnings over the past year. The findings were detailed in a report released by the Miian Group, which examined the cybersecurity landscape for civil society in Iran. The report identified three specific instances of spyware attacks on Iranian nationals, with two occurring within Iran and one in Europe, all of which were communicated to the victims in April. Amir Rashidi, the director of digital rights and security at Miian Group, explained that two of the targeted individuals come from a politically active family that has faced severe repression, including executions, yet they have not traveled abroad. Rashidi expressed concerns about the ongoing threat, suggesting that there have likely been multiple waves of attacks and asserting that further investigation is essential to fully understand the extent of the issue. He stated, "I see no reason for members of civil society to be targeted by anyone other than Iran." Kashfi, who established the security firm DarkCell, mentioned that he assisted some victims with preliminary forensic assessments, although he could not definitively identify the spyware used in these incidents. Notably, some victims chose not to pursue further investigation due to fears related to their safety and employment. The identity of the spyware manufacturer remains uncertain, but Apple has previously informed users about threats posed by well-known entities like NSO Group and its Pegasus software. This malware, often referred to as 'commercial' or 'mercenary' spyware, has been implicated in numerous global surveillance cases. Since 2021, Apple has sent notifications to users in over 150 countries, underscoring the widespread nature of government-sponsored spyware. However, the company does not disclose specific countries or the total number of affected individuals. To support victims of such spyware attacks, Apple has advised those who receive threat notifications to connect with AccessNow, a digital rights organization that offers a 24/7 helpline staffed by experts in spyware investigations. As the situation unfolds, Apple has yet to comment on the specific notifications sent to Iranian users.