Apple has been warning Iranian iPhone users that they are under threat from cyber espionage in the months leading up to the Iran-Israel conflict.
Security researchers and human rights organizations are uncovering instances where smartphones owned by Iranians have been attacked with spyware. Tens of smartphones have been targeted by malware earlier in 2025, as discovered by Miaan Group of Texas and DarkCell of Sweden.
The attempted attacks also sparked a response from Apple, which warned iPhone owners at risk that they were targets of malware attacks.
The attacks are considered to be the first known example of the use of cyber espionage tools and malware being used against Iranians living within Iran, and also abroad, Bloomberg.
The victims include dissidents within Iran as well as an Iranian citizen living in Europe.
It is unknown who was actually behind the attacks, but work is still being carried out to determine that. However, investigations are proving tricky, in part because full forensic examinations of the iPhones cannot be carried out.
Part of this is due to the victims being inside Iran itself, with some only coming forward months later. Other victims have handed their iPhones to the Iranian government's security services for examination.
However, what is known is that the attacks are being carried out by someone with vast resources. The attacks reportedly cost in the ballpark of millions of dollars, and were as sophisticated as Pegasus spyware attacks.
The expense and technicality of the attacks mean they are not carried out against a large mass of people, but rather against a small targeted group. This tends to be people of interest to a state or country's law enforcement and security agencies, and can include activists and journalists.
Apple's warnings
A key part of the attacks is that Apple notified people who were targets. The initial notification was a text message from the company to the victims.
In the notification, Apple explained to the people that it used spyware with some of the "most advanced digital threads in existence today."
Apple explained that the attacks are probably targeted "because of who you are or what you do," adding that it has "high confidence" in the warning.
The warnings have been a policy of Apple's since 2021, intended to help victims of state-sponsored spyware attacks. The warnings have since been sent out to victims in more than 90 countries since the policy was adopted.
Apple also has a dedicated about the threat notifications, explaining ways that users can protect themselves and other things they can do. This includes enabling , a setting that strictly limits the features of the iPhone to prevent attacks from succeeding.
