originally, my sysdiag revealed some questionable configuration profiles with no clear names as well as other suspicious/ambiguous activity. mainly i noticed "OrderedProfiles^HiddenProfiles" in PayloadManifest, and it spooked tf outta me. i decided today to do a new sysdiag and have since confirmed that this config profile is related to my carrier, not a rogue or malicious mdm as previously thought. i suggest using chatgpt to parse files "MCSettingsEvents.plist" and "UserSettings".

hi all, just wanted to quickly update as i have done some digging which has helped uncovered a few things. firstly, i suggest all to do a sysdiagnose of their device and look thru /logs/MCState/shared and /user. these contain config files related to mdm/dep and will confirm the presence of configuration profiles.

hi there, i notice it has been a few years since your post. could you please provide an update. did this turn out to be true?

hi, i am very interested in your reply. since it has been a few months could you possibly provide an update? has more evidence of compromise been uncovered?

hi there, very interested in your reply. where can i contact you for more info?

hi, may i ask where you found the following "MDM-enrollment is mandatory: YES" do you have any "managedappdistribution" related logs in analytics data? where can i contact you to hear more? im super interested in your findings.

hi. i am very interested in your reply as i have been experiencing similar issues but without any hard proof of compromise. i hate to say this but some of this may simply be normal ios activity as it just does not make sense to me how this is possible. the threat actor would have to have access to some insanely rare, obscure, and expensive zero click vulnerabilities to pull off something like this. nevertheless, i do think something fishy is going on and would love to know more about ur findings