Miaan Group: a number of Iranians received spyware threat alerts from Apple in H1 2025 in the months prior to the Iran-Israel war, the first such cases in Iran
More than a dozen Iranians' mobile phones were targeted with spyware in the months prior to the country's war with Israel, according to new research.
Context & Ripple Effects
Apple’s threat-notification system had already expanded to people in 92 countries through a broad global wave of mercenary-spyware warnings, while earlier alerts to Indian opposition figures showed how consequential these notices can become when suspected state-linked surveillance enters public view.
This report adds Iran to that documented notification map and places the cases before a period of heightened Iran-Israel tension. It is evidence of targeting, not attribution or proof that any phone was compromised.
First-order effects
- More than a dozen alerted Iranians gain a concrete signal to reassess device security and possible exposure to highly targeted surveillance.
- Miaan Group’s findings establish the first documented Apple spyware threat alerts in Iran, giving local defenders and researchers a new reference point for tracking targeted mobile threats.
Second-order effects
- Apple’s warnings can turn otherwise private targeting into actionable intelligence for Iranian security researchers and affected organizations, increasing scrutiny of suspected spyware activity.
- The cases reinforce demand for independent mobile-device assessment: recent evidence of an active iPhone spyware campaign had already underscored that targeted attacks can surface beyond their presumed geographic or political targets.
Third-order effects
- If alerts continue to surface across conflict-linked environments, platform notifications may become an increasingly important public record of targeted surveillance even when technical attribution remains unavailable.
- The pattern points to mobile devices becoming a more central intelligence and influence surface, with defensive visibility depending heavily on platform detection and independent research.
The trend: This is one data point in the widening use of mobile surveillance around political and geopolitical conflict—and in platform alerts becoming a key, imperfect signal of that activity.