Prayer App Used by Millions Hacked to Broadcast Defection Messages Amid U.S.-Israel Strikes on Iran

A popular Iranian prayer timing application, BadeSaba Calendar, was hacked to deliver anti-government push notifications to millions of users.

This cyber incident occurred early Saturday morning, coinciding with joint U.S. and Israeli military strikes on Iran.

While the kinetic strikes targeted physical locations, this coordinated cyber operation sought to broadcast messages of defection directly to the mobile devices of Iranian citizens and military personnel.

Incident Overview

Aspect	Details
Target Application	BadeSaba Calendar (5 Million+ Downloads)
Attack Vector	Push Notification System Hijacking
Incident Timing	Payloads Triggered at 9:52 AM Tehran Time
Payload Message	“Help Has Arrived” / Military Defection Orders
Attribution	Unknown (Suspected Nation-State Operation)
Collateral Impact	National Internet Connectivity Dropped to 4%

The BadeSaba Calendar app, which has been downloaded over 5 million times from the Google Play Store, began sending bursts of push notifications at 9:52 AM Tehran time, as reported by Wired.

Instead of standard prayer timings, users received messages titled “Help is on the way”. The notifications urged Iranian military personnel to surrender their weapons, promising amnesty and forgiveness.

One translated message stated that the time for revenge had come, while another called on oppressive forces to lay down their weapons and join the forces of liberation.

Cybersecurity experts indicate this was a highly sophisticated operation, likely involving the hijacking of the application’s push notification architecture.

Morey Haber, chief security advisor at BeyondTrust, noted that the compromise of these assets likely happened well in advance of the actual event.

Rather than a standard smash-and-grab ransomware attack, the messages were timed payloads triggered to align perfectly with the kinetic military strikes, pointing to a nation-state level of precision and pre-planning.

Digital Blackouts and Broader Cyber Warfare

As the hacked notifications spread, Iran experienced a severe nationwide digital blackout. According to the global internet monitoring tool NetBlocks, overall network traffic in the country plummeted to just 4 percent of its ordinary levels.

Data from ArvanCloud’s Radar monitoring system confirmed that many of the country’s main data centers and domestic Points of Presence lost international connectivity.

This severely degraded mobile data, fixed broadband, and made using virtual private networks almost impossible for civilians.

The cyber warfare campaign extended far beyond mobile applications. Several state-affiliated news agencies, including IRNA and ISNA, were targeted by simultaneous cyberattacks that temporarily knocked their websites offline or hijacked them to post anti-regime content.

Narges Keshavarznia, a digital rights researcher at the Miaan Group, highlighted that attribution for these hacks remains complex.

However, the resulting internet disruption effectively limits the ability of civilians to document events, seek help, or inform the outside world, creating a dangerous loss of visibility during a critical geopolitical conflict.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.