While monitoring the traffic of our own corporate Wi-Fi network, we noticed suspicious activity that originated from several iOS-based phones. Since it is impossible to inspect modern iOS devices from the inside, we created offline backups of the devices, inspected them and discovered traces of compromise.

Some iPhones at Kaspersky got hit by a zero-click RCE. They go into the forensic methods they used.