Apple alerted Iranians to iPhone spyware attacks, say researchers

Apple has informed more than ten Iranians in recent months that their iPhone has targeted government spyware, according to security researchers.

The Mayyan Group, a digital rights organization that focuses on Iran, and Hamid Kashefi, the Iranian cybersecurity researcher who lives in Sweden, said that they had spoken with many Iranians who received notifications last year.

Bloomberg first wrote about these signs of espionage programs.

The Mian Group published a report on Tuesday on the state of civil society in Iran, which stated that researchers in the organization identified three cases of government spyware attacks against the Iranians, two and two in Iran and one in Europe, who were alerted in April this year.

Amir Rashidi, director of digital and security rights at the Mian Group, told Techcrunch: “Two people in Iran came from a family with a long history of political activity against the Islamic Republic. Many members of their family have been executed, and they have no history of traveling abroad,” said Amir Rashidi, Director of Digital and Security Rights at the Mian Group. “I think there were three waves of attacks, and we only saw the tip of the iceberg.”

Rashidi said that Iran is likely to be the government behind the attacks, although there should be more investigations into these attacks to reach a more severe decision. “I do not see any reason calling on civil society members to target them by anyone other than Iran,” he said.

Kashefi, who founded the Darkcell security company, said in an email that he had helped two victims to go to initial forensic steps, but he was unable to confirm the spyware maker who was behind the attacks. He added that some of the victims who worked with them prefer not to continue the investigation.

“All the victims have fallen greatly and we ghost as soon as we clarified the seriousness of the case to them.

It is not clear that any spyware maker behind these attacks.

Over the past few years, Apple has sent several rounds of notifications to people whom the company believes has targeted government spyware, such as Pegasus’s NSO Group or Paragon’s Graphite. This type of malware is also known as “mercenary” or “commercial” spyware.

The notifications helped security researchers focus on spyware to document violations in many countries such as India, El Salvador and Thailand.

On the Apple Support page for the company’s “threat notifications”, the last update in April, the technology giant said that since 2021, users have been informed in “more than 150 countries”, showing the extent of the spread of government spyware. Apple does not reveal the names of countries, nor the total number of the people I have informed.

To help the victims, since last year, Apple recommended those who have received these threat signs to communicate with the Accessnow digital rights group, which runs a clock aid line equipped with researchers who can investigate spyware attacks. Accessnow has documented abuse of spyware around the world.

Apple did not respond to a request to comment on the notifications sent to the Iranians.