Suspicious iPhone 18.1.1 update behavior and App Store issues

I phone seems hacked. No access to apple. ID or cloud. Settings constantly changed and App Store is weird. Believe they may have got me when loaded 18.1.1 although I was suspicious of phone before downloading update.


Here is analytics data

bug_type":"225","timestamp":"2024-11-23 16:23:07.00 -0800","os_version":"iPhone OS 18.1.1 (22B91)","roots_installed":0,"incident_id":"E9551F17-3DC5-4640-AC0D-9B7866848CB1"}

[{"osVersion":"18.1.1","rangeEndTime":1732407787,"eventType":"installs","eventVersion":1,"itemId":"951937596","topic":"xp_amp_app_usage_dnu","bundleId":"com.microsoft.Office.Outlook","shortAppVersion":"4.2445.2","hardwareFamily":"iPhone","anonymous":true,"installType":"redownload","count":1,"appVersion":"1.0","externalVersionId":"870607098","storefront":143441,"baseVersion":1,"os":"iOS","bundleVersion":"32780930","eventTime":1732407787686,"clientEventId":"D6D607C4-BD09-42DA-9117-B4231C375A6A","usageClientId":"75785AE1-E5F9-4FA5-98BB-1101D79704DE","clientOnlyProperties":{},"timezoneOffset":480,"app":"com.apple.appstored","rangeStartTime":1732349352},{"osVersion":"18.1.1","rangeEndTime":1732407787,"eventType":"launches","eventVersion":1,"itemId":"364709193","topic":"xp_amp_app_usage_dnu","bundleId":"com.apple.iBooks","shortAppVersion":"11.1","hardwareFamily":"iPhone","anonymous":true,"rangeStartTime":1732349352,"count":2,"appVersion":"1.0","baseVersion":1,"os":"iOS","bundleVersion":"6269","eventTime":1732407787716,"clientEventId":"7F37974D-1095-46A5-971A-FFD269CE4685","isSystemApp":true,"usageClientId":"75785AE1-E5F9-4FA5-98BB-1101D79704DE","clientOnlyProperties":{},"timezoneOffset":480,"app":"com.apple.appstored","foregroundDuration":125},{"osVersion":"18.1.1","rangeEndTime":1732407787,"eventType":"launches","eventVersion":1,"itemId":"951937596","topic":"xp_amp_app_usage_dnu","bundleId":"com.microsoft.Office.Outlook","shortAppVersion":"4.2445.2","hardwareFamily":"iPhone","anonymous":true,"rangeStartTime":1732349352,"count":1,"appVersion":"1.0","externalVersionId":"870607098","storefront":143441,"baseVersion":1,"os":"iOS","bundleVersion":"32780930","eventTime":1732407787717,"clientEventId":"6699E640-5BD4-4BF1-B9B5-6582E3B2798D","usageClientId":"75785AE1-E5F9-4FA5-98BB-1101D79704DE","clientOnlyProperties":{},"timezoneOffset":480,"app":"com.apple.appstored","foregroundDuration":36},{"osVersion":"18.1.1","rangeEndTime":1732407787,"eventType":"launches","eventVersion":1,"itemId":"1069513131","topic":"xp_amp_app_usage_dnu","bundleId":"com.apple.weather","shortAppVersion":"5.0","hardwareFamily":"iPhone","anonymous":true,"rangeStartTime":1732349352,"count":1,"appVersion":"1.0","baseVersion":1,"os":"iOS","bundleVersion":"789.3","eventTime":1732407787717,"clientEventId":"20BCD3B6-092D-4831-92AA-6D8F4EB960DD","isSystemApp":true,"usageClientId":"75785AE1-E5F9-4FA5-98BB-1101D79704DE","clientOnlyProperties":{},"timezoneOffset":480,"app":"com.apple.appstored","foregroundDuration":8},{"osVersion":"18.1.1","rangeEndTime":1732407787,"eventType":"launches","eventVersion":1,"itemId":"805410450","topic":"xp_amp_app_usage_dnu","bundleId":"com.beckettmedia.app","shortAppVersion":"4.10","hardwareFamily":"iPhone","anonymous":true,"rangeStartTime":1732349352,"count":2,"appVersion":"1.0","externalVersionId":"869306897","storefront":143441,"baseVersion":1,"os":"


[Re-Titled by Moderator]

iPhone 12, iOS 18

Posted on Nov 23, 2024 5:00 PM

Reply
Question marked as Top-ranking reply

Posted on Nov 30, 2024 1:48 PM

I have the same. I have confirmed bad actors installed Trojan. Look for changes in Shortcut. Accessibility. Focus and screen time. Even apple support gets redirected to legit looking copies of app. Lockdown mode helps but not with everything. Devices are controlled at the root level and hard resets won’t remove issues. I reset 15 times just to see. Nada. And of course someone always says no one will find anything. A bit naive in today’s world. Good luck.


{"bug_type":"226","timestamp":"2024-11-28 20:36:09.00 -0600","os_version":"iPhone OS 18.1.1 (22B91)","roots_installed":0,"incident_id":"30B618D5-9DF6-41EC-8851-6E2291E9E627"}

{"postTime":1732847769546.2351,"events":[{"CloudServicesAnalyticsDoubleRecovery-success":0,"CloudServicesiCloudIdentity-hardfail":0,"eventType":"CloudServicesHealthSummary","CloudServicesRecoverEscrowWithRequest-success":1,"CloudServicesAnalyticsRestoreKeychainWithBackupBag-hardfail":1,"CloudServicesAnalyticsDoubleEnrollment-hardfail":1,"CloudServicesAnalyticsRestoreKeychainWithBackupBag-softfail":0,"topic":"xp_coreos_securebackup","modelid":"iPhone14,8","hard_failure_count":5,"CloudServicesAnalyticsiCDPKeybag-

4 replies
Question marked as Top-ranking reply

Nov 30, 2024 1:48 PM in response to Dilango

I have the same. I have confirmed bad actors installed Trojan. Look for changes in Shortcut. Accessibility. Focus and screen time. Even apple support gets redirected to legit looking copies of app. Lockdown mode helps but not with everything. Devices are controlled at the root level and hard resets won’t remove issues. I reset 15 times just to see. Nada. And of course someone always says no one will find anything. A bit naive in today’s world. Good luck.


{"bug_type":"226","timestamp":"2024-11-28 20:36:09.00 -0600","os_version":"iPhone OS 18.1.1 (22B91)","roots_installed":0,"incident_id":"30B618D5-9DF6-41EC-8851-6E2291E9E627"}

{"postTime":1732847769546.2351,"events":[{"CloudServicesAnalyticsDoubleRecovery-success":0,"CloudServicesiCloudIdentity-hardfail":0,"eventType":"CloudServicesHealthSummary","CloudServicesRecoverEscrowWithRequest-success":1,"CloudServicesAnalyticsRestoreKeychainWithBackupBag-hardfail":1,"CloudServicesAnalyticsDoubleEnrollment-hardfail":1,"CloudServicesAnalyticsRestoreKeychainWithBackupBag-softfail":0,"topic":"xp_coreos_securebackup","modelid":"iPhone14,8","hard_failure_count":5,"CloudServicesAnalyticsiCDPKeybag-

Dec 21, 2024 4:46 PM in response to Dilango

My iPhone has been hacked. I have tried to get help and my Google. Also my Google account has an admin over it because someone has changed my account to a business type account and I believe the same thing with Apple somebody attached to enterprise my maps are being spoofed on iPhone and Google they’re using copy and paste and I believe the developers app in Apple. I don’t know what to do. This is my personal account. Nobody should be in charge of anything on either one of my accounts, Apple or Google.

Nov 23, 2024 5:44 PM in response to Dilango

No one on here will be able to find anything useful in the data you shared. It’s highly unlikely that you are hacked especially with any relation to the iOS update but have you contacted Apple Support directly about whatever issues you are having? When you say no access to Apple ID or iCloud…what exactly happens? Error messages? What settings are changed? (And what about those settings makes you think hacked since I would think that if someone went through the trouble to hack you as an individual they would do something far more useful than change most settings). If you’re seeking help even on this forum the more details you give about your actual issues the better.

Jan 4, 2025 4:41 AM in response to JohnnySmith888

Do you know what specific Trojan? Or can you provide more details? I’ve had my devicee, and there have been so many iPhones, iPads. Androids, etc. compromised in various forms. But I have similar issues as you habe listed.


Im trying to gather as much knowledge as possible and it’s tricky staring details on a public forum from a compromised device, but if possible you’d be helping me and others. People need to speak out and these bot like “Oh no, iPhones can’t be attacked you’re crazy and I’m a cyber genius” replies should be ignored or downvoted unless the poster has actually put some effort into trying to help on a community help forum. I could have a lot to say about those types but wasted energy. I’ll just say yeah, some people are a bit paranoid or anxious over nothing but some of us have had detrimental impacts in our lives because of these issues they are so quick to take their time to make a silly post. No one who’s gone through in my case, cybertorture,

is looking for confirmation biased comments, we don’t care what you think (probably not to much thinking involved). We’re looking for help and trying to help others,and reaching out, spreading awareness shouldn’t bother anyone, especially if they provide details that are obviously “off.”


thanks for speaking out and posting! To the op as well.

Suspicious iPhone 18.1.1 update behavior and App Store issues

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple Account.