My iPhone 13 had become unusually slow before I saw a strange pop-up on the Home Screen containing a URL that may have ended in .jp. After restarting, I noticed that my Gmail and possibly my Apple account seemed compromised. Safari opened an unfamiliar unsecured website, accessibility options such as Braille appeared to change by themselves, Bluetooth kept turning back on, and an option related to transferring audio to a HomePod repeatedly re-enabled even though I do not own one. The phone also appeared to be responding to taps or moving through settings without me touching it.
While my wife and I were trying to investigate using her phone, a page appeared in her browser addressing me by name. I also had an old 2015 MacBook signed into the same Apple ecosystem. When I later used it, windows and tabs seemed to move on their own, Wi-Fi re-enabled itself, and changing the keyboard language appeared to stop the behavior. I have since changed passwords, disabled family sharing, updated my devices, and set up my current iPhone as new rather than restoring the old backup. I have not used the MacBook since.
What could realistically explain this behavior, and what steps should I take before using the old MacBook or linking any devices to my accounts again?
3 Answers
Some of these symptoms can come from a damaged touchscreen, ghost touches, a faulty screen protector or charger, accessibility shortcuts, browser redirects, or account and device settings syncing unexpectedly. Bluetooth or an audio-transfer setting turning back on does not by itself prove someone was controlling the phone. A strange page using your name could also have come from a browser session, a shared account, or information already stored in a website. Keep screenshots and exact timestamps if anything happens again, disconnect the device from networks, and contact Apple Support through an official channel. Check your router too: change its administrator password, update its firmware, and remove unknown connected devices.
The old MacBook is the biggest technical concern here. A compromised computer could expose browser sessions, passwords, or Apple account credentials, while the iPhone itself is much less likely to allow ordinary remote control without a very serious exploit. Do not sign the Mac back into your accounts yet. If you need to preserve files, copy only personal documents using a trusted, updated computer, then erase the Mac completely and reinstall the newest macOS version it supports. Ideally, have Apple or a reputable technician inspect it first. Also review your Apple account's device list, trusted phone numbers, sign-in history, forwarding rules, browser extensions, and recovery methods, and use a unique password with two-factor authentication.
It is reasonable to investigate security, but try not to conclude that every unusual setting change was remote access. If the behavior continues after a clean setup with updated hardware, have the phone examined for physical touch or button faults and ask a qualified security professional to review the account logs. Also consider speaking with a doctor or trusted person if you are experiencing events that others cannot independently observe, major sleep disruption, or fear that devices are acting against you. A carbon-monoxide check is also sensible if anyone in the home has headaches, confusion, dizziness, or similar symptoms.
That makes sense. I have left the MacBook powered off for months because I was afraid it would reconnect to everything as soon as it started. I will avoid logging into it and have it erased or checked before using it again.