The Evolution of iPhone Spyware: 18 Years of Cat-and-Mouse Games

Early Days: Jailbreak Spyware (2007 Onward)

The backbone of Apple’s security model from the outset is that it doesn’t allow apps from outside the App Store. To get around this, attackers turned to a process called jailbreaking.

Jailbreaking removes Apple’s software restrictions, allowing installation of unauthorized apps—including spyware.

In the late 2000s, tools like FlexiSPY and MobileSpy appeared, offering powerful surveillance features. These apps could record calls, track GPS, read texts (even deleted ones), and secretly activate the microphone or camera.

But they required physical access. The attacker needed to jailbreak the device and manually install the spyware—something that could usually only be done by someone close to the victim.

Over time, Apple made jailbreaking increasingly difficult. With each iOS update, new security protections made it harder for the jailbreak community to keep up.

But jailbreak-based spyware didn’t disappear, it remained in use even as other spying methods emerged. In fact, some spyware makers even returned to it later, when newer Apple security updates made alternative spying methods (e.g. iCloud hacking) more difficult.

Even today, jailbreak spyware still exists. It’s harder to install, and fewer users have vulnerable devices, but it continues to be marketed online, particularly in cases where the attacker has close access to the victim.

Cloud Surveillance: The iCloud Backup Method

Around 2014, as jailbreaking started to become less reliable, spyware vendors looked for alternatives. They found a new opportunity in iCloud.

By default, many iPhones automatically backup to iCloud. These backups include messages, call logs, photos, app data, and more.

Spyware companies realized that if an attacker had access to the victim’s Apple ID and password, they could remotely download these backups—without touching the iPhone at all.

This method became known as “non-jailbreak” spyware and was marketed as easier and safer than physical installation.

With access to iCloud backups, attackers could view:

• SMS and iMessage conversions
• WhatsApp and other messaging apps
• Photos and videos
• Calendar entries
• Location history
• App data from every installed app
• Contacts and call history
• Safari history

This kind of spyware was particularly dangerous because it didn’t require anything to be installed on the phone itself. And it could be set up from anywhere, as long as the attacker had the login credentials.

But Apple eventually caught on.

Apple’s Response: Locking Down iCloud

In response to growing abuse, Apple began enforcing two-factor authentication (2FA) on iCloud accounts. By 2022, over 95% of iCloud users had 2FA enabled.

With 2FA in place, even if someone had your password, they couldn’t log into your account without access to a one-time code sent to your trusted device.

Apple also introduced alerts for new logins, improved detection of suspicious activity, and an option to encrypt iCloud backups end-to-end with Advanced Data Protection.

Then in 2020, Apple changed how third-party apps could interact with iCloud. Most notably, it blocked access to full iCloud backups for outside services.

Today, spyware tools that once relied on this method can only access “synced” iCloud data—like contacts, iMessages, and photos—rather than the full backup.

This didn’t stop spyware companies entirely, but it greatly limited what they could access using the iCloud method. As a result, many began shifting focus again—this time, to a little-known feature in iTunes.

Exploiting iTunes: The Wi-Fi Sync Method

As jailbreaking became harder and iCloud access tightened, spyware makers turned their attention to a new avenue: iTunes Wi-Fi sync.

iTunes allows iPhones to back up wirelessly to a computer on the same network. While convenient, this feature created a privacy risk when abused.

With brief access to a target’s phone, an attacker could set up automatic Wi-Fi syncing to their own computer. This meant the iPhone would periodically back up to the attacker’s computer—no cables, no prompts, and no alerts.

Once backups were available, spyware tools running on the computer could extract and upload the data to a web dashboard for the attacker to view.

This method was particularly popular in domestic abuse situations, where the attacker had easy access to the victim’s devices and home network.

It also became a preferred method among some commercial spyware services. Unlike jailbreaking, it worked on the latest iPhones. And unlike the iCloud method, it didn’t require login credentials.

But again, Apple eventually stepped in.

Apple Responds: Passcode Required for Backups

In 2022, Apple released iOS 16.1, which included a subtle but powerful change.

Now, any time a backup is initiated—whether over USB or Wi-Fi—the user must enter their device passcode.

This meant spyware relying on Wi-Fi sync could no longer silently pull data. The iPhone would prompt the user every time, making the attack obvious and easily disrupted.

As a result, this method became much harder to use without the victim noticing. Many spyware tools that relied on Wi-Fi sync were rendered ineffective unless the attacker also knew the device’s passcode and could repeatedly access the phone.

It was a quiet but important win for user privacy.

Nation-State Spyware: Enter Pegasus