{"id":11040,"date":"2026-03-02T10:03:37","date_gmt":"2026-03-02T10:03:37","guid":{"rendered":"https:\/\/serisec.com\/index.php\/2026\/03\/02\/hacked-prayer-app-used-as-cyber-weapon-during-us-israel-strikes-on-iran\/"},"modified":"2026-03-02T10:03:37","modified_gmt":"2026-03-02T10:03:37","slug":"hacked-prayer-app-used-as-cyber-weapon-during-us-israel-strikes-on-iran","status":"publish","type":"post","link":"https:\/\/serisec.com\/index.php\/2026\/03\/02\/hacked-prayer-app-used-as-cyber-weapon-during-us-israel-strikes-on-iran\/","title":{"rendered":"Hacked Prayer App Used as Cyber Weapon During US-Israel Strikes on Iran"},"content":{"rendered":"<p>    Hacked Prayer App Used as Cyber Weapon During US-Israel Strikes on Iran<br \/>\n \t<BR><br \/>\n<BR><\/BR><br \/>\n    <!-- no image --><br \/>\n \t<BR><br \/>\n<BR><\/BR><\/p>\n<div>\n<p>As Israeli and US forces launched joint preemptive airstrikes on Tehran, a sophisticated cyber-psychological operation unfolded simultaneously.<\/p>\n<p>According to a report by Wired Middle East, millions of Iranian citizens and military personnel were jolted awake not only by explosions but also by <a href=\"https:\/\/cybersecuritynews.com\/microsoft-teams-phishing-attack\/\" target=\"_blank\" rel=\"noreferrer noopener\">unauthorized push notifications<\/a> from a compromised mobile application.<\/p>\n<p>The incident signaled a new escalation in nation-state cyber warfare, blending digital intrusion with kinetic military operations.<\/p>\n<h2 class=\"wp-block-heading\" id=\"h-prayer-app-hijacked-during-military-strikes\"><strong>Prayer App Hijacked During Military Strikes<\/strong><\/h2>\n<p>The primary vector for this digital offensive was the \u2018BadeSaba Calendar,\u2019 a popular prayer timing application with over 5 million downloads on the <a href=\"https:\/\/cybersecuritynews.com\/beware-of-website-mimicking-google-play-store\/\" target=\"_blank\" rel=\"noreferrer noopener\">Google Play Store<\/a>.<\/p>\n<p>As noted by\u00a0Wired story, shortly after the physical strikes began on Saturday morning, <a href=\"https:\/\/cybersecuritynews.com\/notepad-hijacked\/\" target=\"_blank\" rel=\"noreferrer noopener\">the app\u2019s notification system was hijacked<\/a> to broadcast messages of psychological warfare.<\/p>\n<p>Starting at 9:52 AM local time, users received a burst of push notifications titled \u201cHelp is on the way\u201d.<\/p>\n<p>Screenshots shared with\u00a0Wired Middle East revealed that these messages explicitly urged Iranian military members to abandon their posts and lay down their weapons in exchange for amnesty.<\/p>\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-large\"><img data-recalc-dims=\"1\" decoding=\"async\" src=\"https:\/\/i0.wp.com\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEj7dzZlrB8cWzti1ilwd1uLryhQnDTw_DW-7iiH5l3TvTCi-3Gu9SvpXHUYznlfeBmJR5LkDA1frb2jhSfYhKdHB7uVk4V_mCWlYobxDZIgLj0XC9nXdTFGQ4N3O_i983pY3yq8SIy7TFBkwXAeIFFTyAsfcwJdKSm8GuykLXmkutFusck1e_luSCN1hMc\/s1600\/Screenshot%25202026-03-02%2520105359%2520%25281%2529.webp?ssl=1\" alt=\"Hacked Prayer App\"><figcaption class=\"wp-element-caption\">The push notifications are all titled \u201cHelp is on the way \u201d and urged Iranian troops to surrender (source: Wired)<\/figcaption><\/figure>\n<\/div>\n<p>At 10:02 AM, a subsequent alert warned that \u201crepressive forces will pay for their cruel and merciless actions,\u201d while another message at 10:14 AM called on forces to join the \u201cliberation\u201d for a free Iran.\u200b<\/p>\n<p>While the exact <a href=\"https:\/\/cybersecuritynews.com\/hackers-abuse-windows-file-explorer-and-webdav\/\" target=\"_blank\" rel=\"noreferrer noopener\">malware or exploitation technique<\/a> remains unidentified,\u00a0Wired Middle East highlighted analysis from cybersecurity experts who assess this as a highly coordinated nation-state operation rather than a standard cybercriminal attack.<\/p>\n<p>Morey Haber, Chief Security Advisor at BeyondTrust, told the publication that an attack of this scale requires advanced planning.<\/p>\n<p>The threat actors likely compromised the application\u2019s backend infrastructure well in advance, staging the notifications as triggered payloads perfectly timed to coincide with the kinetic airstrikes.\u200b<\/p>\n<p>Currently, attribution remains unconfirmed, with no hacker organization or state entity officially claiming responsibility for <a href=\"https:\/\/cybersecuritynews.com\/uber-hack\/\" target=\"_blank\" rel=\"noreferrer noopener\">the breach<\/a>.<\/p>\n<p>Speaking to\u00a0Wired Middle East, Narges Keshavarznia, a digital rights researcher at the Miaan Group, stated that it is too early to determine whether the operation was carried out by Israeli intelligence or by anti-government <a href=\"https:\/\/cybersecuritynews.com\/pro-iranian-hacktivists-targeting-us-networks\/\" target=\"_blank\" rel=\"noreferrer noopener\">Iranian hacktivist groups<\/a>.<\/p>\n<h2 class=\"wp-block-heading\" id=\"h-severe-nationwide-internet-disruptions\"><strong>Severe Nationwide Internet Disruptions<\/strong><\/h2>\n<p>Simultaneous to the app compromise, Iran experienced a severe digital blackout. As documented by\u00a0Wired Middle East, this is a familiar defensive or suppressive tactic used during periods of national crisis.<\/p>\n<p>According to the internet monitoring tool NetBlocks cited in the report, national network traffic plummeted to just 4 percent of normal levels.<\/p>\n<figure class=\"wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter\">\n<div class=\"wp-block-embed__wrapper\">\n<div class=\"embed-twitter\">\n<blockquote class=\"twitter-tweet\" data-width=\"550\" data-dnt=\"true\">\n<p lang=\"en\" dir=\"ltr\"><img data-recalc-dims=\"1\" decoding=\"async\" src=\"https:\/\/i0.wp.com\/s.w.org\/images\/core\/emoji\/17.0.2\/72x72\/26a0.png?ssl=1\" alt=\"\u26a0\" class=\"wp-smiley\" style=\"height: 1em; max-height: 1em;\"> Update: <a href=\"https:\/\/twitter.com\/hashtag\/Iran?src=hash&amp;ref_src=twsrc%5Etfw\">#Iran<\/a>&#8216;s internet blackout has now passed the 24-hour mark with national connectivity flatlining at 1% of ordinary levels.<\/p>\n<p>The measure limits civic engagement at a key moment for the country&#8217;s future after the killing of Ayatollah Khamenei in US and Israeli airstrikes. <a href=\"https:\/\/t.co\/W4jDgds1Ty\">pic.twitter.com\/W4jDgds1Ty<\/a><\/p>\n<p>\u2014 NetBlocks (@netblocks) <a href=\"https:\/\/twitter.com\/netblocks\/status\/2028008024430813368?ref_src=twsrc%5Etfw\">March 1, 2026<\/a>\n<\/p><\/blockquote>\n<p><script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script>\n<\/div>\n<\/div>\n<\/figure>\n<p>Data from ArvanCloud, a <a href=\"https:\/\/cybersecuritynews.com\/opensource-cloud-security-tools\/\" target=\"_blank\" rel=\"noreferrer noopener\">domestic cloud service operator<\/a>, indicated that major data centers and domestic points of presence lost international connectivity.\u200b<\/p>\n<p>Furthermore,\u00a0<a href=\"https:\/\/www.wired.me\/story\/hacked-prayer-app-sends-surrender-messages-to-iranians-amid-israeli-strikes\" id=\"https:\/\/www.wired.me\/story\/hacked-prayer-app-sends-surrender-messages-to-iranians-amid-israeli-strikes\" target=\"_blank\" rel=\"noreferrer noopener nofollow\">Wired reported that state-affiliated news agencies<\/a>, including IRNA and ISNA, were taken offline by suspected coordinated cyberattacks.<\/p>\n<p>Digital rights advocates warned that these communication outages severely degrade mobile data, fixed broadband, and <a href=\"https:\/\/cybersecuritynews.com\/claims-to-have-unauthorized-fortinet-vpn\/\" target=\"_blank\" rel=\"noreferrer noopener\">VPN access<\/a>, eliminating visibility and preventing civilians from documenting the unfolding events or seeking help.<\/p>\n<p class=\"has-text-align-center has-background\" style=\"background:linear-gradient(180deg,rgb(238,238,238) 94%,rgb(169,184,195) 100%)\"><strong>Follow us on <a href=\"https:\/\/news.google.com\/publications\/CAAqMggKIixDQklTR3dnTWFoY0tGV041WW1WeWMyVmpkWEpwZEhsdVpYZHpMbU52YlNnQVAB?hl=en-IN&amp;gl=IN&amp;ceid=IN:en\" target=\"_blank\" rel=\"noreferrer noopener nofollow\">Google News<\/a>, <a href=\"https:\/\/www.linkedin.com\/company\/cybersecurity-news\/\" target=\"_blank\" rel=\"noreferrer noopener nofollow\">LinkedIn<\/a>, and <a href=\"https:\/\/x.com\/cyber_press_org\" target=\"_blank\" rel=\"noreferrer noopener nofollow\">X<\/a> for daily cybersecurity updates. <a href=\"https:\/\/cybersecuritynews.com\/contact-us\/\" target=\"_blank\" rel=\"noreferrer noopener nofollow\">Contact us<\/a> to feature your stories.<\/strong><\/p>\n<p>The post <a href=\"https:\/\/cybersecuritynews.com\/hacked-prayer-app\/\">Hacked Prayer App Used as Cyber Weapon During US-Israel Strikes on Iran<\/a> appeared first on <a href=\"https:\/\/cybersecuritynews.com\/\">Cyber Security News<\/a>.<\/p>\n<\/div>\n<p> \t<BR><br \/>\n <BR><\/BR><br \/>\n    Abinaya<br \/>\n \t<BR><br \/>\n<BR><\/BR><br \/>\n<a href=\"https:\/\/cybersecuritynews.com\/hacked-prayer-app\/\">Go to cyber-security-news<\/a><br \/>\n \t<BR><br \/>\n <BR><\/BR><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Hacked Prayer App Used as Cyber Weapon During US-Israel Strikes on Iran As Israeli and US forces launched joint preemptive airstrikes on Tehran, a sophisticated cyber-psychological operation unfolded simultaneously. According to a report by Wired Middle East, millions of Iranian citizens and military personnel were jolted awake not only by explosions but also by unauthorized [&hellip;]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[129,63],"tags":[130],"class_list":["post-11040","post","type-post","status-publish","format-standard","hentry","category-cyber-security","category-cyber-security-news","tag-cyber-security-news"],"_links":{"self":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts\/11040"}],"collection":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/comments?post=11040"}],"version-history":[{"count":0,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts\/11040\/revisions"}],"wp:attachment":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/media?parent=11040"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/categories?post=11040"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/tags?post=11040"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}