Persistent mystery app “clo” showing all signs of being malware

I discovered a mysterious app in my iPhones and iPads that I can’t get rid of, and the date showing as its installation date coincides with the time I started to notice some obvious evidence of hacking, such as temporary (but brief) control of my screen, and deletions of photos that I didn’t do.


The app is called “clo” (all lowercase) and appeared only in the Passwords app and in Sign In With Apple. I was able to delete it easily from Passwords without having it return. On Sign In With Apple, though, it returns immediately after I click “Stop Using” then “Delete”. Every other app I had there was easily removed with those two steps.


Apple engineers are looking into this but I have not received any real new information on what the app is or how to get rid of it.


Has anyone else encountered “clo”?

iPhone 16 Pro Max, iOS 26

Posted on Nov 26, 2025 2:34 PM

Reply
4 replies

Dec 7, 2025 1:23 AM in response to jamiefrommerrick

Never seen “clo” myself, but stuff that only shows up in Passwords or Sign In With Apple is usually just a leftover login entry from an app or site you signed into once, not an actual app installed on the device. The fact that it pops back up probably means something you use is still requesting that Apple-login token, so it just respawns the entry even after you delete it.


If Apple is already looking into it you’re on the right track. I’d also give your devices a quick scan with something like certo antispy just to rule out anything else.

Persistent mystery app “clo” showing all signs of being malware

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple Account.