Leaked Cellebrite document reveals new iPhone unlock tool bypassing Stolen Device Protection
A leaked confidential Cellebrite document describes 'Advanced Unlocks,' a new 2026 product that can extract data from iPhones even with Stolen Device Protection enabled, using a dedicated appliance with an approximately 8-meter range.
Summary
Security researcher Justin.sh has published details from a leaked Cellebrite document describing 'Advanced Unlocks' (AU), a new product for 2026. The tool is designed as a 'next-generation AFU vector' that remains effective against Apple's operating system updates and works even when Stolen Device Protection is active. Unlike previous Cellebrite offerings, AU requires a dedicated hardware appliance with a stated operational range of about 8 meters. AFU refers to the 'after first unlock' state, when an iPhone remains vulnerable to certain attacks before being rebooted.
How Advanced Unlocks differs from prior Cellebrite methods
- AFU state targeting: Works against iPhones in 'after first unlock' state, not BFU (before first unlock)
- Stolen Device Protection bypass: Functions even when Apple's anti-theft USB restrictions are active
- Wireless/radio vector: 8-meter range suggests a radio-based attack rather than physical cable connection
- Dedicated appliance: Requires specialized hardware, not software-only deployment
- Resilience claim: Cellebrite documents state it is designed to survive future Apple OS updates
Why it matters
The leak intensifies scrutiny of the forensic technology industry's capabilities and the arms race between device security and law enforcement tools. If the 8-meter wireless range is accurate, it represents a significant operational shift from Cellebrite's traditionally cable-dependent extraction methods.
What to do
- Reboot your iPhone regularly to return it to BFU (before first unlock) state, since the attack only works against AFU (after first unlock) state.
- Keep Stolen Device Protection enabled, as this tool bypasses it but it still provides protection against other attacks.
- Watch for future Apple OS updates that may address this attack vector, since Cellebrite claims resilience to current update patterns.
Original reference: www.schneier.com →