Loading story…
Magnet Forensics has reportedly developed tools that counter Apple’s iPhone inactivity-reboot protection, according to an October 1 report by 404 Media cited by CyberVeille and Schneier on Security. The iOS safeguard automatically restarts an iPhone after 72 hours without an unlock, returning it to the Before First Unlock (BFU) state and making forensic data extraction significantly harder. A dedicated device called GrayKey Preserve and Evidence Preservation Mode for existing GrayKey devices reportedly keep seized phones in a more accessible state before that reboot occurs.
A leaked video reportedly describes the tools as countering both inactivity reboot and the automatic deletion of certain forensic data; Magnet claims they can preserve that data indefinitely. The products are marketed to law enforcement agencies facing delays in examining seized devices, while the reporting also raises concerns about GrayKey use in authoritarian countries. No technical exploit details, vulnerability identifier, or confirmed Apple fix were provided, leaving the mechanism and scope unverified; security teams should not treat inactivity reboot as a guaranteed barrier to forensic access when a device is physically seized.
Get the actors, campaigns, and ATT&CK mapping behind it.
2 events from the most recent confirmed update back to the earliest known activity.
On October 1, 2026, 404 Media reported, based on an obtained video, that Magnet Forensics developed GrayKey Preserve hardware and Evidence Preservation Mode for existing GrayKey devices to counter iPhone inactivity reboot. The technology also targets automatic deletion of data such as cached locations and recently deleted photos and iMessages, which a Magnet employee claimed it could preserve indefinitely.
A disclosure described Apple’s iOS inactivity-reboot feature, which restarts an iPhone after 72 hours without an unlock. The restart returns the device to the Before First Unlock state, making forensic data extraction significantly harder.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
3 references tracked. Mallory keeps watching after this page renders.
schneier.com
Open sourcecyberveille.ch
Open source404media.co
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Magnet Forensics sued former contractor Mario Del Gaudio and competitor Paradigm Shift Technology S.L. in federal court in Georgia, alleging they misappropriated trade secrets tied to an iOS zero-day affecting Apple `A12` and `A13` chips. According to the complaint, Del Gaudio worked on the vulnerability while under contract with Magnet and later researched the same flaw for Paradigm Shift after leaving. Paradigm Shift subsequently published research on the issue, then removed the post after the lawsuit was filed. The disputed vulnerability is described as a boot ROM flaw affecting devices including the iPhone XS and iPhone 11 families, making it effectively unpatchable through normal iOS software updates. Magnet argues the public disclosure destroyed part of the exploit's commercial value for government surveillance and forensic customers and caused ongoing damage, turning the case into a high-profile dispute over ownership and disclosure of offensive mobile exploitation research.
Jul 24, 2026
Court filings in a US leak investigation indicate the FBI was unable to forensically extract data from Washington Post reporter Hannah Natanson’s iPhone because **Apple’s Lockdown Mode** was enabled. The government document states the FBI’s Computer Analysis Response Team (**CART**) “could not extract that device,” offering a rare, real-world data point on Lockdown Mode’s effectiveness against at least some standard law-enforcement mobile forensics workflows. The filings also describe limited recovery from the device’s SIM card via a CART tool that produced an auto-generated HTML report containing only the phone number, and note the FBI paused further extraction attempts due to a court “Standstill Order.” The search and seizure occurred amid an investigation into government contractor **Aurelio Perez-Lugones**, whom prosecutors believe was a source for classified information; investigators also reviewed **Signal** messages between Perez-Lugones and the reporter as part of the case. Apple positions Lockdown Mode (introduced in 2022 for iPhone/iPad/Mac) as a high-risk protection that reduces attack surface by restricting attachments, inbound FaceTime from unknown contacts, certain web technologies, and other features.
Jun 29, 2026
Apple said it has not observed any successful mercenary spyware compromises on devices with **Lockdown Mode** enabled, nearly four years after launching the opt-in protection for users at elevated risk of targeted surveillance. Introduced in 2022, the feature hardens iPhones and other Apple devices by disabling or restricting functions that have repeatedly been abused in spyware campaigns, particularly the remotely reachable components used in **zero-click** exploit chains. Independent findings cited by Apple support the claim. Researchers at **Amnesty International** and **Citizen Lab** said they have not seen evidence of successful infections on Lockdown Mode-enabled iPhones, and Citizen Lab documented cases in which the feature blocked **Pegasus** and **Predator** spyware attacks. Google researchers also reported at least one spyware campaign that abandoned infection attempts after detecting Lockdown Mode, while security researcher Patrick Wardle said the feature’s aggressive reduction of attack surface makes it especially effective against exploit delivery methods used by mercenary spyware operators.
Jun 29, 2026