iPhone 12 Pro Max and 3 other iPhones in the households have been compromised - RAT - Spyware - Malware - Hacked

Writing from Toronto, Ontario, Canada

I strongly believe that my phone has been compromised.

A few weeks ago, I noticed unusual behavior on my iPhone 12 Pro Max. About three weeks ago, I was driving back to Toronto and lost cell connectivity, which happens sometimes. However, I noticed my location services arrow was on, prompting me to open the Find My app. Normally, when you open Find My, it shows the last known location before updating to your current location. At 7:08 pm, the app showed my phone at an unfamiliar address in Toronto, which I've never been to. Two minutes later, it updated to show my phone at my home address, and then a few seconds later, at my current location. I have screenshots of all of this. No VPNs were installed, so I found this odd and concerning.

Since then, I've noticed my iPhone randomly using the microphone, camera, and location services—sometimes collectively, sometimes individually. I don't have any apps running in the background, and my location services are set to "only when using the app." I have the Privacy Report turned on and have noticed that my privacy is being accessed multiple times a day when I'm not using the phone.

I've also found full conversations from four specific contacts (out of my 2,000 contacts) in the recently deleted section of iMessage. I recovered them, but noticed someone tried to move them back there again, and then my iMessage syncing was paused indefinitely. Additionally, my Microsoft Authenticator app was tampered with, causing my main account to be deleted from Microsoft's servers. It took four days of phone calls with Microsoft to restore it.

I've experienced other strange behaviors, such as my phone getting extremely hot, some contacts being muted (mainly close contacts like family and friends), and 2FA messages going straight to recently deleted without hitting my inbox. Two other iPhones—both 8 Plus models—are experiencing similar issues, but my phone seems to be the most affected.

I started using a new loaner phone (iPhone 11 Pro) and a new iPhone 15 Pro Max, but I've noticed strange things happening on those as well, such as the mic, camera, and location services activating on the iPhone 11 Pro, and touched screen movements on the iPhone 15 Pro Max without any physical contact.

I'm tech-savvy, and I don't let anyone use my phone. It's secured with a long alphanumeric password, and it's not jailbroken—none of them are. I've been in touch with Apple Support multiple times, from Level 1 to a Senior Advisor, and even the Apple engineering team. They ran a scan on the phone and reviewed the iOS code, which came back clean, so they weren't concerned. However, they didn't address the vulnerability of their code or the fact that something is clearly wrong. They pawned it off to the local authorities (who have an incident report open but are doing nothing) and my cellular provider (Rogers), who also doesn't care.

I took my phone to a computer forensics company that uses Cellebrite and a UFED machine for a deep scan. They told me they could run the scan, but it would only tell me if the phone was compromised or not, and it would cost the equivalent of two brand-new iPhone 15 Pro Max phones. I declined the scan, but they did mention the phone was exhibiting unusual behaviors.

I'm extremely frustrated with Apple's response. They don't seem to care due to the rarity of the situation and the belief that Apple devices are 100% secure. But they can be compromised—look up Pegasus by NSO Group, or Google: Citizen Lab.

Someone has breached my device, has remote access, and is invading my privacy, stalking me, and harassing me with nonstop calls daily. It's a sad and pathetic situation, and I suspect I know who might be doing this.

There are other threads on the Apple support forum that discuss similar issues.

RAT remote access - Apple Community

I acknowledge and understand the rarity of all of this, however, it does exist.

Has anyone else experienced anything like this? If so, has it been resolved, and how?