Spy apps on iPhones work by exploiting vulnerabilities, configuration profiles, or jailbroken devices to gain unauthorized access to data. These apps can monitor calls, messages, GPS location, browsing history, and more by running in the background, often without the user’s knowledge. On non-jailbroken devices, spy apps might use enterprise certificates or malicious profiles to bypass App Store restrictions and gain access to the device's data. Regular updates, avoiding suspicious links or apps, and reviewing configuration profiles can help protect against these threats.