Overview

• Researchers identified at least 12 targeted Iranians, including domestic government and tech workers and expatriates in Europe, who received Apple threat notifications in early 2025.
• Apple described the attacks as “exceptionally rare” and costing “millions of dollars,” comparing their sophistication to Pegasus-style mercenary spyware.
• Miaan Group and cybersecurity researcher Hamid Kashfi documented the cases but faced limitations on forensic analysis due to security constraints in Iran and delayed reporting.
• Investigators concluded that zero-day, zero-click exploit chains likely powered the campaigns, underscoring their advanced technical sophistication.
• Despite Apple’s “high confidence” in its warnings, the spyware operators remain unidentified, complicating efforts to hold perpetrators to account.