The Miaan Group, a Texas-based digital rights organization, was cited by Bloomberg as saying several Iranians—both inside the country and abroad—received cyber threat notifications from Apple in early 2025.
Victims included two dissidents in Iran and a Europe-based Iranian tech expert. The group believes the number of those affected is likely far higher.
Hamid Kashfi, a Sweden-based cybersecurity researcher and founder of DarkCell, said he identified 12 additional victims—all located inside Iran and working in the tech sector or for government-linked institutions.
According to Bloomberg, Apple characterized the attacks as “exceptionally rare” and costing “millions of dollars,” warning targets that the spyware campaign likely focused on them “because of who you are or what you do.”
The notification compared the operation’s sophistication to Pegasus, the Israeli-made spyware used in state-level cyber-espionage which was revealed by activists and journalists in 2021. Tehran has also frequently deployed international cyber-attacks.
Kashfi said the attacks likely involved “zero-day, zero-click” exploits—techniques that require no user interaction and leverage undiscovered vulnerabilities.
“Zero-click chains are more sophisticated, more expensive, one stage higher than typical hacking campaigns,” he told Bloomberg. “But they weren’t shy about using it and burning it.”
Full forensic examinations were often not possible, either because of access limitations or victims choosing to submit their phones to Iranian authorities rather than independent experts, Bloomberg reported.
It was believed to be the first time such high-grade spyware has been deployed both inside Iran and against members of the Iranian diaspora. The actor behind the operation remains unknown.
Both Kashfi and Miaan declined to reveal the identities of those targeted, citing safety concerns.