apple has alerted iPhone users in Iran to potential state-sponsored spyware attacks, according to researchers. The notifications, sent to individuals believed to be targeted by mercenary spyware, have caused some recipients to cease interaction with security researchers due to the sensitive nature of their work and affiliations.
One victim reportedly received the alert in 2024. The specific spyware manufacturer behind these attacks remains unidentified.
In recent years, Apple has issued multiple rounds of threat notifications to users suspected of being targeted by government-backed spyware. These include sophisticated malware such as NSO Group’s Pegasus and Paragon’s Graphite, often referred to as “mercenary” or “commercial” spyware. These notifications have been instrumental in helping security researchers document instances of spyware abuse in various countries, including India, El Salvador, and Thailand.
According to Apple’s support page on threat notifications, updated in April, the company has notified users in over 150 countries since 2021, underscoring the global prevalence of government spyware. Apple does not publicly disclose the specific countries or the total number of individuals who have received these alerts.
To assist those affected, Apple has, as last year, directed recipients of these threat notifications to the digital rights group AccessNow. AccessNow operates a 24/7 helpline staffed by researchers who investigate spyware attacks and has documented cases of spyware misuse worldwide.
Apple did not provide a comment regarding the notifications sent to Iranian users.