This seems interesting. Is it possible? Definitely possible as long as there are mercenaries performing offensive security work and governments financing those activities. Feasible? It depends on whether you are working on something that might impact or benefit a powerful adversary. In 99 out of 100 cases, it would be a nation-state threat actor performing such an attack. It might not be their tools or personnel, but it will definitely be for their own motivations.
The way it works is that your phone sets up a small private network and acts as the gateway for his connections. This means you technically have more opportunities to︀ perform an adversary-in-the-middle attack where you could manipulate his connections. However, you also open up︁ your phone and some services to his device. While it’s possible, he would need some︂ sort of delivery method on his device as well. So, if something like this occurred,︃ you would be dealing with a very skilled adversary.
As Sergey says, zero days are︄ very expensive and, unfortunately, rare for the public. There is definitely a lot of business︅ going around selling these exploits, so you should be really objective about your identity, your︆ activities and whether there is some benefit to bringing out the big guns and bucks︇ to compromise you.
But you should also define what you constitute as strange behavior (how︈ are the applications not loading? Do they appear blank, shut down, make your phone freeze?,︉ because you are mentioning it on your phone and your watch. Funnily enough, I met︊ a well-known forensic expert a while ago who mentioned to me that they (law enforcement)︋ already have methods to extract data from Apple Watches with just access to the iPhone︌ for forensic investigations. I have not done a deep dive into this, but if you︍ are able to perform forensics this way, then it is safe to say that ‘hopping’︎ devices is also possible.
Normally, I would say do not touch your device and see️ a forensic expert who specializes in mobile devices ASAP, but that might not be easy to find in your case, nor would you perhaps be willing to pay a hefty amount for a deep dive that might not have been needed.
So I can also recommend you do the following:
• Disconnect any shared networks (WiFi/Ethernet) where the devices could potentially connect to other devices.
• Persistence is key in most attacks and actually way harder to pull off on iOS, as mentioned you have already rebooted your device. You could potentially wiped some valuable evidence because of this, for instance, information about how the︀ attack occurred could be stored here. But if the attacker already has established persistence, this︁ won’t matter as the malicious code will probably appear in memory again.
• Attackers have︂ used the Shortcuts app on iOS in the past; this could be used to configure︃ certain triggers to run a malicious executable again to help an attacker connect to your︄ device. If you use the app, try to see whether unknown automations have appeared in︅ the Shortcuts app.
• Also, I think you mentioned somewhere that you were in IT.︆ What you could potentially do is set up your own DNS server and configure it︇ as the DNS server for the iPhone. This way, you can also see what connections︈ your devices make and identify any anomalies in the connections, assuming they connect to a︉ C2 (Command & Control) server via HTTP/DNS.
The good news is, you do not have︊ Android, where it is much easier to trick you into giving more privileges to attackers.︋
