Was just made aware today that the latest iOS version seems to be spying on itself.
SUMMARY:
On iOS 18.6, the system daemon 'tccd' silently initiates TCCAccessRequest calls with the flag
'preflight=yes' across **multiple** privacy-protected domains including Contacts, Camera, FaceID,
Microphone, Calendar, Reminders, Bluetooth, and App Tracking Transparency (ATT).
These accesses:
- Occur without user interaction
- Do not trigger any permission prompt
- Are not associated with any user-facing app (client_dict=(null))
- Originate from internal Apple daemons (daemon_dict=)
- Are invisible in Privacy Settings
This appears to be a systemic, undocumented telemetry or policy enforcement mechanism operating below the app layer, capable of silently querying or accessing sensitive user data.