Iran Expands Sophisticated Spyware Campaigns Globally

In the context of escalating tensions before and after the June 2025 Iran-Israel conflict, Iranian-linked cyber-espionage campaigns have intensified, targeting both domestic and expatriate Iranians. Apple has issued threat notifications to more than a dozen Iranian users, mainly in government or the tech sector, warning of sophisticated mercenary spyware attacks, with indications that the actual scope is larger. Simultaneously, the Iranian state-affiliated group MuddyWater has deployed new variants of its DCHSpy Android spyware, distributing it through fake VPN and banking apps, including those themed around Starlink internet access during government blackouts. DCHSpy is capable of extracting extensive personal data from Android devices and shares infrastructure with the SandStrike spyware. These developments underscore the increasing sophistication, scale, and reach of Iranian state-backed digital surveillance and politically motivated cyber operations in the region.