Identifying Unauthorized Access to iCloud Files and Photos

Nobody here can help with advanced exploits or sophisticated malware or such.

If not already reviewed, and implemented as appropriate…

Run Safety Check:

Personal Safety User Guide - Apple Support

Verify you know all of the trusted devices.

Change your Apple ID password:

If you think your Apple ID has been compromised - Apple Support

Enable two-factor authentication, if not already enabled.

If your equipment meets the requirements, enable Advanced Data Protection:

Advanced Data Protection for iCloud - Apple Support

Change your device passcode to something with 8, 12, or even more characters.

Enable and use Face ID to avoid needing to enter the longer passcode quite as often.

It is vanishingly rare to find evidence of compromises in logs.

I’ve yet to see any evidence of compromises post4d around here.

Lots of screenshots of ominous but benign log and telemetry chatter, sure, but no evidence.

If you suspect compromise, then follow what I suggested above. You particularly suspect what amounts to hugely valuable and espionage-like exploits targeting iCloud, which puts investigating that far outside the realm of a casual discussion and some screenshots, too.

Evaluating or decontaminating a device is an expensive and tedious project at best, the results are far from certain*, and the effort requires direct and extended access to the device or service to rummage.

*conclusively proving a negative—that a device is not hacked, or that iCloud is not hacked—is somewhere between difficult and impossible.

MrHoffman I need your help please!?? Could you just kinda glance over some logs and extensions that are questionable…. Would you please be willing to talk to me, please???