What should I do if my iPhone shows unusual activity?

Mac Jim, I appreciate you taking time to share your thoughts on potential unauthorized MDM on my device. I NEED folks like you to hold the hand of this kindergartener:)

I will share my thoughts now...I am more confused than ever. It was here, within this community, that I found a member with similar symptoms in their phone and the reply received included confirmation of an unauthorized MDM. I get such different answers every time I call Apple support, too. In fact, in a recent call to Apple I said it is possible to install an MDM without physical contact and NO profile seen (only a serial number is needed per Google Workplace admin info page), the supervisor very politely (actually I felt badly for him because he was clearly trying so hard to be sensitive and let me down gently:) stated he had never heard of such a thing and Apple would have informed his department. Not true. In my ongoing research, I found a clear description of the issue and this description is confirmed by Apple. Description is available in...is it called Gethub? And as I recall it was in an update offered with security repairs ("patches"?) and the number began with "17". Entitled "Shortcuts".

What puzzles me now regarding what I found is (a) the supervisor had no idea this event happened. Not his fault, I assign responsibility to big decision makers within Apple who failed to ensure awareness, and (b) the update with repairs was issued to mac devices only. I looked and saw no iOS ones. So, I am still losing data and now device content. Another Shortcut was located today along with activity mentioning "Trusted Contacts" associated with my Google account. Research showed a "Trusted Contact" is the person who Google will contact if no activity occurs for a specified amount of time (death). I found the trusted contact activity in the section where app and web time can be limited (cant recall what its called:). Here I also found items suggesting a developer type of access - not regular Joes like me. Things with "Webkit" and "Auth" or maybe it was "OAuth" were present during one hour slots where I was not using my device. So right now, I feel I am uncertain still but leaning toward the idea of an invader in need of a firm spanking. Contacting Apple again soon, then FCC, and wishing I had the phone number of a parent of the misbehaving invader.

One other supervisor shared good realistic advice. He said "vintage flip phones do not have bluetooth" - I still have my old flip phone:)

Again, I appreciate your reply.

Gandolf243, thank you for sharing your thoughts, I appreciate your suggestions and have a question regarding this. You mention "tracking" the responsible party. I am wondering if you can elaborate more? How can I do this? Do you have experience in tracking in a similar situation? If so, how do I start? Thank you.

Jeff,

Thank you for the links to extra information, I appreciate both.

I am keenly aware of what my question suggests. I wish I had only positive questions, or at least, none that highlighted the darker side of humanity. While doing my best to tread lightly wherever the rights of others overlap with mine, and with appreciation for "...until proven guilty", I have only myself to figure this mess out (and y'all:). Tempering emotional responses to an all-out invasion and take over of devices is challenging for anyone. If I err in any manner, I respond best to the same sort of kindness I receive in this forum. It still takes a village! That said, reference to suspected source location is relevant considering specific technology required for some nefarious maneuvers.

**Gotta Say...between this forum and the developers site, I learn more almost hourly. I appreciate Y'all!!

((FOUND IT))

Hi Mac Jim ID,

I wanted to share what I have found regarding the presence of Corporate Accounts in System Settings. I may try to add these screenshots again solely for info and enlightenment because so many of us are experiencing this - all while NO profile is shown in VPN & Device Management. In addition to the blank black area where an MDM profile should be visible, I also have more screenshots from various apps and features within settings that show similar behavior. By this I mean the printed words suggest SOMETHING is below them, yet all I see is black and blank. I have been wondering if the absence of an MDM is through a type of redaction process? Should someone bring this to the attention of Apple? (seeking a volunteer, I don't speak techy effectively:)

The two pics from my phone are while on a cellular connection. I pay monthly for only one cellular provider: StraightTalk (no Wifi except the stalker/hacker free WiFi) I will post additional nuggets in reply to relevant comments.

The third screenshot is found at support.apple.com.

Are there other methods for backup if one does not have a Mac? (Or any other laptop brand, nor desktop).

Can a backup be completed directly from an iOS device to a thumb drive?

Thanks!

Thank you for the link. I found some great ideas there.