Can iPhones get viruses, and what happens instead

Why the classic kind has nowhere to go

A virus, in the original sense, is a program that copies itself into other programs. To do that it needs somewhere to write a copy and permission to run it. Apple’s own platform security documentation describes three mechanisms that remove both, and it is worth reading them as specifics rather than as reassurance.

Every third-party app is sealed off. In Apple’s words: “All third-party apps are sandboxed. Sandboxing is designed to prevent apps from gathering or modifying information stored by other apps or from making changes to the device.” Each app gets “a unique home directory for its files, which is randomly assigned when the app is installed”, and reaches anything outside it only through services iOS chooses to provide.

Permissions cannot be forged. Access to your information and to features such as iCloud is governed by declared entitlements, and because “entitlements are digitally signed, they can’t be changed”. Apple adds that ordinary APIs “don’t allow apps to escalate their own privileges to modify other apps” or the operating system.

And there is nowhere to write. The plainest sentence in the document is also the most consequential: “the entire operating system partition is mounted as read-only.” Apple notes too that “unnecessary tools, such as remote login services, aren’t included in the system software”. Two further protections sit underneath — address space layout randomisation, which scrambles where code sits in memory, and ARM’s Execute Never feature, which marks memory pages as non-executable.

None of this makes an iPhone unbreakable, and Apple does not claim it does. What it does is make self-spreading software the wrong tool: the rare real attacks on iPhones are aimed at individuals at great expense, which is a different problem with a different answer.

The second wall, with numbers on it

The other reason is the store. “Apple reviews every app” is repeated everywhere and is almost never given a size, which makes it impossible to judge. Apple publishes the size once a year, and the report covering 2025 came out on 20 May 2026.

App Review “evaluated more than 9.1 million app submissions” and “rejected over 2 million app submissions — including over 1.2 million new apps and nearly 800,000 app updates”. Within that: over 22,000 rejected “for containing hidden or undocumented features”, and over 443,000 “for privacy violations”.

The most interesting figure is not about submissions at all. Apple describes apps “that were initially approved as standard games or utilities, such as a puzzle or calculator app, that then modified their software post-review with the intent of financial fraud”, and says that “in 2025, the team removed nearly 59,000 apps” for doing it. That is review failing and being caught afterwards, published by the company that runs the review — and it is the honest reason to keep an eye on what is installed even on a phone that only uses the official store.

Outside the store the numbers get blunter. Apple says it “detected and blocked 28,000 illegitimate apps on pirate storefronts, which include malware”, and that “in the last month alone” it prevented “2.9 million attempts to install or launch apps distributed illicitly outside the App Store or approved alternative app marketplaces”.

One caveat belongs with all of it. These are Apple’s figures about Apple’s own work, and nobody audits them. They are quoted here because a number with a date attached can at least be argued with, which an adjective cannot — not because the source is neutral.

What does happen, which is four things and none of them a virus

A web page. By far the most common. A page displays a countdown, a fake scan or a warning that several viruses have been found. It is a website: it cannot see the phone it is drawn on, it has no access to your photos or messages, and it goes away when Safari’s website data does.

A configuration profile. The only ordinary mechanism by which something outside the App Store changes how your iPhone behaves — it can set a VPN, a proxy or restrictions, and Apple’s personal safety guidance warns that such tools “may allow access to data or location information on the device”. It arrives by being tapped through, usually on a page that was offering something else. That is the one worth checking, and how to remove virus from iPhone is where the check and its two warnings are set out step by step.

Your Apple Account password. Not an infection at all. Someone signing in as you sees your photos, messages and location without anything being installed anywhere, which is precisely why no scanner could ever find it. The signs are account-shaped rather than device-shaped: messages you did not send, sign-in alerts, changed settings.

And, rarely, a targeted attack. Mercenary spyware exists, and Apple runs a notification system for it. In Apple’s words these are “high-confidence alerts that a user has been individually targeted”, and “the vast majority of users will never be targeted by such attacks”. If it happens you are told, on the Lock Screen and in Settings, by email, and by a banner on your account page — not by an app you installed.