How iPhone Zero-Click Attacks Evolved From FORCEDENTRY to BLASTPASS

BLASTPASS: a different delivery route and another patch cycle

Two years later, Citizen Lab’s BLASTPASS report described a chain using PassKit attachments containing malicious images sent through iMessage. The researchers reported that it could compromise an iPhone running iOS 16.6 without interaction and attributed its use to NSO Group’s Pegasus spyware.

Apple’s iOS 16.6.1 advisory lists CVE-2023-41064 in ImageIO and CVE-2023-41061 in Wallet, with possible active-exploitation statements for both. Citizen Lab also said it believed Lockdown Mode blocked the attack.

The BLASTPASS page in this Intelligence Center provides a focused business analysis of the 2023 chain. This comparative article instead examines what changed and what remained necessary across the two cases.

What evolved between the cases

Attackers adapted to platform defenses

Citizen Lab framed FORCEDENTRY as a response that bypassed BlastDoor. BLASTPASS later used a reported PassKit and image-processing path. This pattern illustrates a general defensive reality: a mitigation can eliminate or constrain one route while well-resourced attackers search for another reachable parser, attachment type, service, or trust boundary.

The lesson is not that mitigations fail. Isolation, safer parsing, memory protections, code signing, sandboxing, and reduced feature exposure increase attacker cost and can block known techniques. The lesson is to combine them with updates and response instead of treating one control as final.

Public evidence became a multi-source record

Both cases involved researcher findings and Apple advisories. FORCEDENTRY also received detailed Project Zero analysis. A mature intelligence process separates these roles:

• the affected vendor confirms vulnerability scope and releases fixes;
• researchers report forensic observations and attribution conclusions;
• independent analysts may validate technical characteristics; and
• organizations decide how the evidence affects their own inventory and risk.

Do not turn repeated reporting of one original claim into independent corroboration. Link to the underlying primary record.

Apple added an exceptional-risk mode

Apple introduced Lockdown Mode after FORCEDENTRY and before BLASTPASS. Apple describes it as an extreme optional protection for people at risk of highly sophisticated attacks. Citizen Lab believed it blocked BLASTPASS.

That is meaningful defensive evidence, but not a universal guarantee. The Lockdown Mode guide for executives explains how to select users, test functional impact, record exceptions, and maintain support.

What did not change

Current software remains essential

Each public case led to a vendor update. An organization needs a process that turns an advisory into an affected-device query, deadline, support plan, enforcement action, exception decision, and verified build result. Use the business iPhone update-management guide and verify current releases with Apple—not historical numbers in this article.

User training cannot stop every delivery path

Training still reduces phishing, credential theft, malicious installation, unsafe sharing, and support fraud. But a zero-click report means the user may have no suspicious action to avoid. Security leaders should not blame a target for failing to detect an invisible delivery.

High-risk users need a defined service

Organizations should know who might face exceptional targeting and how to support them. The program should cover device updates, Lockdown Mode evaluation, Apple Account security, trusted communications, travel, assistants, administrative access, replacement devices, specialist escalation, and personal safety.

The secure iPhone business travel guide and Apple Account security-key guide provide related operational controls.

Evidence and identity response remain separate workstreams

A phone can be locked or erased while cloud sessions remain active. Conversely, revoking sessions does not preserve device evidence. The incident lead must coordinate forensic, device, identity, application, carrier, safety, communications, legal, and recovery decisions.

Use the suspected iPhone spyware response guide and the Apple threat-notification response guide before improvising during a high-risk case.

A modern organizational defense model

1. Inventory: know device ownership, model, build, enrollment, last check-in, role, and sensitive access.
2. Update: monitor Apple advisories and enforce risk-based deadlines.
3. Reduce exposure: evaluate Lockdown Mode and minimized applications/data for exceptional-risk users.
4. Protect identity: secure recovery, primary email, trusted devices, administrative roles, and cloud sessions.
5. Prepare response: offer an alternate reporting channel, evidence decision, secure replacement, and specialist escalation.
6. Communicate carefully: separate vulnerability, targeting, attempt, compromise, attribution, and impact.
7. Exercise: run a scenario in which the user did nothing suspicious and the first signal is a vendor notification or researcher contact.

The Paragon Graphite iPhone case shows why these lessons remained relevant in later reported mercenary-spyware research without implying that every case shares the same mechanism or operator.

Build defenses that do not depend on a click

OC Security Audit can review iPhone vulnerability management, high-risk-user protection, identity controls, threat-notification handling, and evidence-ready incident response. Contact OC Security Audit and review the experience of Ali Hassani, CISO—25+ years across cybersecurity, compliance, infrastructure, and IT leadership.

Update and correction history

• August 2026: Apple source links were revalidated and updated to current official canonical destinations; the surrounding analysis and conclusions were unchanged.
• August 2026: Initial comparative analysis prepared from Citizen Lab, Apple, and Google Project Zero sources available through August 1, 2026.