Apple iOS · Public exploit code

PDF via AirDrop compromises iPhone in Lockdown Mode; malware survives update

Nov 03, 2026 · 1 min read

A video posted by the account @IntCyberDigest shows an iPhone 18 Pro in Lockdown Mode running iOS older than 27.2 compromised just by receiving a PDF via AirDrop. The compromise is persistent: updating to the latest iOS does not remove the malware. Sources cite no CVE or fix for the flaw; update the system and consider restoring the device if compromise is suspected.

By HIFY Radar newsroom Updated 11/03/2026 08:53 PM Get this every day →← Back to the feed 1 source

HighVulnerabilityPublic exploit codeFix unconfirmed

In this article

What happened
Why it matters
What to do
For the technical team
Timeline
Sources

What happened

A released video shows an iPhone 18 Pro in Lockdown Mode running iOS older than 27.2 compromised just by receiving a PDF via AirDrop. The compromise is persistent: updating to the latest iOS does not remove the malware.

Why it matters

Employees with iPhones on an old version could be infected when receiving a file over AirDrop, even with the maximum protection mode enabled. Once infected, a regular system update does not remove the malware, which stays on the device.

What to do

Update company iPhones to the latest iOS version. If infection is suspected, consider restoring the device, since the update does not remove the malware according to the video.

For the technical team

Affected: Apple iOS (recebimento de PDF via AirDrop) · iPhone 18 Pro in the demonstration; iOS older than version 27.2, per the source.
Exploitation: Video demonstration released by the account @IntCyberDigest. No report of real-world exploitation, CVE, or KEV listing in the sources.
Fix: Not stated in the sources. The source only says updating to the latest iOS does not remove the malware after infection.
Vector: File reception via AirDrop on iPhone. Flaw not specified in the sources. Condition: iOS older than 27.2; the video shows compromise just by sending a PDF, with Lockdown Mode enabled.
More details: The video shows two points: infection via PDF over AirDrop on a device in Lockdown Mode and malware persistence after the iOS update. No CVE, group, country, hashes, or indicators cited; discoverer of the flaw not identified in the sources.