Account Hijacked via Developer Management & HomeKit Abuse – Need Recovery GuidancE

Question

Account Hijacked via Developer Management & HomeKit Abuse – Need Recovery GuidancE

My Apple ID and iCloud account were hijacked starting June 11, 2024, after a suspicious individual accessed my device and enrolled it in unauthorized developer management apps (MDM/Enterprise-style). They activated third-party control using HomeKit automations, “Hide My Email” aliases, and developer tools that I never authorized.

I’ve since lost control of:

• iCloud (even after resets)

• Trusted phone numbers and emails

• Home app automations tied to unknown users

• Apple ID security settings

Key Observations:

• Developer tools and HomeKit were used to manage my devices remotely.

• “Hide My Email” aliases were created and used to reroute or spoof identity.

• Mobile Device Management (MDM) and configuration profiles appeared, blocking manual control.

• Multiple unauthorized subscriptions appeared, including third-party number apps (e.g., “TextMe”).

What I’ve Tried:

• Factory resets

• Creating clean Apple IDs and numbers

• Revoking access via appleid.apple.com

• Resetting iCloud and HomeKit

• Contacting Apple Support (but need escalated help)3. Device

Lester’s iPhone

(Model: [Insert Model Here], e.g., iPhone 13 Pro

Posted on Jul 14, 2025 05:45 PM

Reply

Answer 1

muguy

Level 10

90,320 points

Jul 14, 2025 06:17 PM in response to TruthSeekerRealLester

That’s improbable. You cannot remotely access a device as you describe. It’s possible that your Apple Account has been compromised. See If you think your Apple Account has been compromised - Apple Support

you can also review devices signed into your account at account.apple.com

Reply

Answer 2

Jul 14, 2025 06:50 PM in response to TruthSeekerRealLester

Whatever you are reporting here and that’s been ongoing for a year, with all that has happened and with all of your efforts toward remediation, and with no indications of loaded profiles or no indications of developer mode being enabled, is not going to get solved here today. If at all.

What you are reporting having happened here involves immensely expensive tooling, and your reported adversary very well funded, and puts this report well past what folks in most any forum can address.

Not without forensics access and some deeply personal questions about your own situation, your observations, and your own security and privacy and other risks.

Reply