A popular Iranian prayer app turned cyber weapon amid escalating tensions. The BadeSaba Calendar app, with over 5 million Google Play downloads, blasted anti-government push notifications to users right as U.S. and Israeli strikes hit Iran.
This cyber op aimed to spark military defections, syncing perfectly with physical attacks.
Incident Overview
The hack struck early Saturday at 9:52 AM Tehran time. Instead of prayer alerts, millions got messages like “Help Has Arrived” urging soldiers to surrender weapons for amnesty.
Experts call it a sophisticated push notification hijack likely pre-planned by nation-state actors.
| Aspect | Details |
|---|---|
| Target Application | BadeSaba Calendar (5 Million+ Downloads) |
| Attack Vector | Push Notification System Hijacking |
| Incident Timing | Payloads Triggered at 9:52 AM Tehran Time |
| Payload Message | “Help Has Arrived” / Military Defection Orders |
| Attribution | Unknown (Suspected Nation-State Operation) |
| Collateral Impact | National Internet Connectivity Dropped to 4% |
As reported by Wired, Attackers compromised the app’s backend push system, probably via supply chain infiltration or credential theft.
Morey Haber, chief security advisor at BeyondTrust, says this setup happened weeks ahead. Timed payloads activated during strikes, bypassing app stores’ quick patches. No malware drop, just psychological ops straight to devices.
This beats typical ransomware; it’s precision info warfare. Users couldn’t opt out easily, as notifications ignore do-not-disturb on Android.
Digital Blackouts and Wider Impacts
Notifications triggered chaos. NetBlocks data shows Iran’s internet crashed to 4% normal levels.
ArvanCloud Radar confirmed data centers lost global links, crippling mobile data, broadband, and VPNs.
State media like IRNA and ISNA faced DDoS or hijacks, posting anti-regime messages briefly. Digital rights expert Narges Keshavarznia from Miaan Group notes attribution stays murky amid blackouts.
Civilians lost tools to report events or connect externally, amplifying isolation.
App devs must secure push services with API key rotation, anomaly detection, and multi-factor auth. Nation-states now weaponize everyday apps scan yours for shadow compromises. Iran’s response? Likely stricter app vetting, but blackouts hid details.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
%20(1).webp?fit=1600,900&ssl=1&description=A popular Iranian prayer app turned cyber weapon amid escalating tensions. The BadeSaba Calendar app, with over 5 million Google Play downloads,){kind=link}