Apple has now issued multiple warnings to iPhone users as “mercenary spyware” is detected in the wild. These start as highly targeted attacks on specific groups of individuals. But the exploits then filter down the food chain, attacking more devices. Here are three hidden settings to check whether you’re being secretly monitored.
The best defense against spyware is to ensure your iPhone is eligible for security updates and that it’s running the latest version of the OS. Right now that means iOS 26.0.1 assuming you’ve upgraded to iOS 26, with iOS 26.0.2 expected imminently.
There are three semi-hidden settings you should also check, as they’re red flags that your iPhone might be infected with something. Remember, while sophisticated spyware attacks are deployed remotely, it’s much easier for someone you know to trick you into installing an app or software that could open your iPhone to monitoring.
The first thing to check is data usage by app: Settings > Mobile Service or Cellular Data, and then review data usage by app. Tap on Show All to see the full list. Browsers, music and streaming apps, social media apps and email apps will top the list, as will VPNs.
Put very simply, if there are any apps you don’t recognize that are consuming lots of data, you should remove these from your iPhone. General rule of thumb — a gigabyte or more of data should only be consumed by blue chips apps you use regularly.
Next check battery use by app. Settings > Battery > View All Battery Usage. Click on two or three recent days and review the list. Again, your browser, social media, messaging, streaming and email apps should dominate.
If there are any battery hogs you don’t recognize, then open the app to see what is is, and if it’s not something you’re using, remove it from your iPhone. You can also see if apps are engaged in “Background” activity that doesn’t seem warranted.
Spyware apps need to operate regularly and return data to remote servers. That consumes battery and data. While unsophisticated attacks use apps, more targeted attacks will hide as background services. Under the data list, you can also open System Services and see if any background service standout as being unexpected. Most of this will be absolutely normal, but check any unexpected data usage that stands out.
Third and finally, check the recent apps installed on your iPhone. You do this by looking at the “Recently Added” group of apps in the last home screen window if you swipe left. As with the data and battery settings, look for anything unusual or unexpected.
There are some more complex settings you can check as well, if you have reason for concern. The first is for unrecognized profiles in Settings > General > VPN & Device Management. You should only see VPNs you have installed yourself or work profiles if you have a company administered device. You can tap for more details.
You can also check app permissions via Settings > Privacy & Security > App Privacy Report. This gives you a comprehensive view on tracking and data harvesting on your iPhone. But for this spyware exercise, focus on Data & Sensor Access.
You know the drill by now, look for anything you don’t recognize.
If you’re in a high-profile vocation, a high-risk location, or you have other reasons to fear you might be targeted, then consider Apple’s Lockdown Mode as a strong defense against many types of attack, albeit this materially affects how iPhone works.
Meanwhile, Apple has just doubled its top bug bounty to $2 million, as the cat and mouse hunt for spyware and its developers continues.
