Lockdown Mode was the last answer
For years the advice to journalists and officials facing mercenary spyware was blunt: turn on Lockdown Mode. It strips message previews, most attachments and web features, leaving less surface to reach.
That advice now looks thinner. A team calling itself Calif showed an iPhone 18 Pro running Lockdown Mode unlocked through a malicious PDF pushed over AirDrop. The person on the device accepted the file first.
What the recording showed
After the file opened, the group moved the handset onto iOS 27.2 and the modified state held rather than resetting with the restart. How a device that shipped with 27.2 would fare has not been tested in public.
Calif has not named the bug. The clip shows a start and an end, and that is the extent of the public evidence.
Accepted by the owner
The trigger matters. This was no zero-click chain. Someone had to take the file, so a target who ignores an unexpected AirDrop never reaches the vulnerable code.
Where it fits
Nine days before, the same group took an iPhone Duo apart on its launch day through a bug reachable at boot, a class Apple cannot fix in software when the earliest code is baked into silicon. This demo works against the live system, and a chain that holds across a version change is awkward to close.
What Apple has said
Apple’s stated position, set out in March, is that no mercenary spyware campaign had been shown to beat Lockdown Mode.
Nothing in the footage contradicts that, since the clip documents a handset opened by its owner, not an infection.
No arsenal release is planned, and the group says it hands findings to the company rather than to users. Owners have no patch to apply today.
