Over twelve Iranian mobile phones were targeted by spying software months before the country’s war with Israel, according to a new study.

The Miaan Group Digital Human Rights Organization, based in Texas, has identified several Iranians who received threat alerts from Apple Inc. In the first half of 2025. Researchers believe this is only part of the total victims. An additional wave of attacks was unveiled by Hamid Kashfi, a Swedish cyber security safety and founder of Darkcell.

These attacks are the first known case of the use of both sophisticated cyber tools both within Iran and against Iranians living abroad. It is not yet clear who is behind the attacks.

The Miaan Group reported that two Iranian dissidents inside the country were among the victims and a technologist, a Iranian citizen living in Europe. On their iPhone, spying software was found, and Apple alerted them with a written message.

Kashfi said he identified 12 victims, all inside Iran, working either in the technological sector or in the government. Both he and the Miaan Group avoided naming the victims for security reasons.

These cyberattacks, which Bloomberg saw, are described as “extremely rare” and cost “millions of dollars”. Apple, although not responsible for a specific one, compared the level of attacks with that of NSO Group’s pegasus spy software.

“Excessive costs, technological complexity and world range make these mercenary digital attacks from the most advanced in the world,” Apple told Iranians. “You’re very likely to be targeted because of who you are or what you do.”

Kashfi estimated that “zero-day zero-click” attacks were used, that is, attacks that use unknown security gaps and do not require any action by the user.

“These Zero-Click chains are more sophisticated, more expensive and a level above the usual hacking campaigns,” he said.
“But they did not hesitate to use them and” burn them “.”

Neither Kashfi nor the Miaan Group managed to make a complete digital analysis of the target iPhones. In many cases this was impossible because users were inside Iran. In others, the victims were notified months after the incident. Finally, some have chosen to deliver their mobile phones for analysis to Iranian government security services rather than independent overseas experts, as Kashfi noted.