iPhones Vulnerable to Malware When Powered Down?

Updated 7 November 2026 · Standard formula, shown below

Yes, iPhones can be vulnerable to malware even when powered down, but the risk is limited to a specific, sophisticated attack method that is not a threat to typical users. Research has shown that certain iPhone components, like the Bluetooth and NFC chips, remain active in a low-power state after shutdown, potentially allowing malicious firmware to be loaded. This article explains how this works, who is at risk, and what you can do to protect yourself.

Background: The Discovery of “Daemon” Attacks

In late 2024, security researchers presented findings on a novel attack vector targeting iPhones that are powered off. The technique, which they named “Daemon,” exploits the fact that Apple’s “Find My” network requires certain hardware to stay on even when the phone is turned off. This feature is designed to help locate a lost or stolen device, but it also leaves the Bluetooth and NFC chips running in a low-power mode. The researchers demonstrated that a skilled attacker could install malicious firmware on these chips, which would then execute when the phone is turned back on. This is a significant departure from previous assumptions that a powered-down phone was completely inert.

How the Attack Works

The attack targets the iPhone’s wireless chips, not the main operating system. When you power down an iPhone, the main processor and iOS shut down, but the Bluetooth and NFC chips remain powered to support the Find My network. An attacker with physical access to the phone could:

Open the phone and connect to the Bluetooth or NFC chip using specialized hardware.
Upload malicious firmware that overrides the chip’s normal functions.
Set the chip to execute malicious code when the phone is next powered on.
Potentially use the compromised chip to interact with the main iOS kernel once booted, though this is the most difficult part.

This attack requires the attacker to have the phone in their possession for an extended period, likely several hours, and to use expensive, custom-built equipment. It is not something that can be done remotely or through a phishing link.

Who Is Actually at Risk?

This attack is not a consumer threat. The complexity and physical requirements mean it is only a realistic concern for high-value targets such as journalists, dissidents, political activists, or government officials who might be targeted by state-sponsored hacking groups. For an average user, the risk of this specific attack is essentially zero. The researchers themselves noted that the attack is “not a threat to the general public” and that it would be “highly unlikely” for a typical iPhone user to be targeted. If you are not a person whose phone might be seized by a government agency or a sophisticated criminal organization, you do not need to worry about this.

Common Misconceptions About iPhone Malware

There are several widespread myths about iPhone security that this research has helped clarify:

“iPhones can’t get malware.” This is false. While iOS is more locked down than other platforms, malware exists for iPhones, usually delivered through enterprise certificates, malicious profiles, or zero-day exploits.
“Powering off protects me.” As shown, powering off does not fully disable all hardware. However, it does stop the main OS from running, which blocks most malware.
“Only jailbroken phones are vulnerable.” This attack targets the hardware, not the OS, so a non-jailbroken phone is still vulnerable. However, the attacker would still need to find a way to exploit the main OS after boot, which is a separate challenge.

How to Protect Yourself

For the vast majority of users, standard security practices are sufficient. The following steps will protect you from the malware threats that actually affect real people:

Keep iOS updated. Apple regularly patches known vulnerabilities. Enable automatic updates in Settings > General > Software Update.
Do not jailbreak your phone. Jailbreaking removes security protections and makes malware installation much easier.
Only install apps from the App Store. Sideloading apps from third-party sources is a common way malware gets onto iPhones.
Be cautious with profiles. Do not install configuration profiles from unknown sources. These can give apps more access than they should have.
Use strong passcodes and Face ID/Touch ID. This prevents physical access to your phone, which is the first step in the Daemon attack.
For high-risk individuals: If you are concerned about physical attacks, consider using a phone that you can fully power off (remove the battery) or storing your phone in a Faraday bag when not in use.

Comparison: iPhone vs. Android in Powered-Down State

Android phones generally do not have a comparable always-on hardware feature like Find My that keeps chips powered when the device is off. However, some Android manufacturers have introduced similar anti-theft features. For example, Samsung’s “SmartThings Find” can use other Samsung devices to locate an offline phone, but the phone itself is typically fully powered down. This means the specific attack described for iPhones is less likely to apply to most Android devices, though other hardware-level attacks could exist. The key takeaway is that no device is completely immune to a determined, well-equipped attacker, but the level of effort required is so high that it is not a practical concern for everyday users.

Frequently Asked Questions

Can my iPhone get malware if I never click on suspicious links?

Yes, but it is rare. Most iPhone malware requires some user interaction, like installing a malicious profile or visiting a compromised website that exploits a browser vulnerability. Apple’s App Store review process and iOS sandboxing make it difficult for malware to spread without user involvement. Keeping your phone updated is the best defense.

Does turning off my iPhone delete any malware?

No. Powering off does not remove malware. It only stops the current processes. When you turn the phone back on, any malware that is stored on the device will still be there. To remove malware, you typically need to uninstall the malicious app or, in severe cases, restore the phone to factory settings.

Is the “Daemon” attack available to hackers on the dark web?

No. The research was presented at a security conference, and the exploit requires custom hardware and deep knowledge of Apple’s proprietary chips. It is not a tool that is sold or shared publicly. State-sponsored groups might develop similar techniques, but they are not available to average cybercriminals.

Should I be worried about my iPhone if I bought it used?

There is a small risk that a used iPhone could have been tampered with, but this is very rare. If you buy a used iPhone, you should check that it is not iCloud locked, update to the latest iOS, and consider a factory reset before using it. This will remove any software that the previous owner may have installed.

Does Apple know about this vulnerability?

Yes. The researchers disclosed their findings to Apple before publishing. Apple has not publicly commented on whether they plan to fix it, but it is likely they are working on a mitigation. In the meantime, the attack remains a theoretical risk for most users.

Can a hacker access my data while my iPhone is off?

No. When the iPhone is off, the main storage is encrypted and inaccessible. The attack described only affects the wireless chips, not the data on the phone. To access your data, the attacker would need to turn the phone on and bypass the lock screen, which is a separate and much more difficult challenge.

Method: the standard formula for this calculation, rounded as each result states. See how the calculators work or report an error.