So far I think there are multiple hypotheses, such as:
- A highly-resourced remote attacker launched Session, switched it from one thread to another to view apps in the second thread, and then forgot to switch it back or close the app.
- The device owner accidentally bumped the screen, causing a thread switch.
- The device owner switched the threads and forgot (perhaps even while asleep -- this happens to some people).
- The device owner accidentally left the device unlocked and somebody picked it up and poked around.
- Somebody guessed the lockscreen PIN, or covertly observed it.
- The Recent Apps display contained an image from some time ago when the device owner was viewing the other thread.
Ruling out #2 through #6 is not easy. Meanwhile, I am unaware of serious remote-access malware that was discovered when a messenger mysteriously switched from one thread to another. Here is a 2025 Citizen Lab analysis of a Paragon attack. Not all of the details of the detection were revealed, but it clearly was not easy.
That piece contains a quote from Apple security experts:
Mercenary spyware attacks like this one are extremely sophisticated, cost millions of dollars to develop, often have a short shelf life, and are used to target specific individuals because of who they are or what they do. After detecting the attacks in question, our security teams rapidly developed and deployed a fix in the initial release of iOS 18 to protect iPhone users, and sent Apple threat notifications to inform and assist users who may have been individually targeted. While the vast majority of users will never be the victims of such attacks, we sympathize deeply with the small number of users who are, and we continue to work tirelessly to protect them.
If your particular device is in scenario #1, i.e., somebody is spending a million dollars to view your Session messages, it's unlikely that this user forum is in a position to counsel you through successfully resisting a nation-state attack.
It would probably be best to consider some mixture of:
- Hire an attorney
- Hire a credentialed security expert (CISSP, CISA, etc.)
- Turn the device off whenever it's not actively in use and/or set the auto-reboot timer to 30 minutes. In turn this might necessitate getting a second lower-security device to leave on all the time for receiving regular phone calls.