'Can't ignore Stryker hit': What is Wiper Malware and how iPhone is at risk if connected to MDM?

When the Iran-linked hacking group Handala breached the medical technology giant Stryker, they didn't just shut down servers; they erased digital lives. Employees across the globe woke up to find their corporate laptops dead and their personal iPhones and Androids completely factory-reset. To understand how this happened, you have to understand the two different weapons the hackers deployed: destructive network malware and the weaponisation of corporate trust.

Most cyberattacks today involve ransomware, hackers lock a company's data and demand millions in Bitcoin in exchange for a decryption key. "Wiper" malware, however, is purely an act of digital terrorism. Threat actors like Handala deploy wipers (such as CaddyWiper or ZeroCleare) with the sole intention of permanently overwriting and destroying data. There is no ransom note and no decryption key. It forces a company to rebuild its entire IT infrastructure from "bare metal," which is exactly why Stryker's stock plummeted the moment the market realized the data was gone, not just locked.

Most cyberattacks today involve ransomware, hackers lock a company's data and demand millions in Bitcoin in exchange for a decryption key. "Wiper" malware, however, is purely an act of digital terrorism. Threat actors like Handala deploy wipers (such as CaddyWiper or ZeroCleare) with the sole intention of permanently overwriting and destroying data. There is no ransom note and no decryption key. It forces a company to rebuild its entire IT infrastructure from "bare metal," which is exactly why Stryker's stock plummeted the moment the market realized the data was gone, not just locked.

While wiper malware destroyed Stryker's internal Windows servers, that is not what erased the employees' iPhones. Handala did not discover a secret "zero-day" vulnerability in Apple's iOS. In fact, they didn't have to hack the phones at all. Instead, the attackers bypassed mobile security entirely by exploiting a backdoor that the employees willingly opened: Mobile Device Management (MDM).

Like millions of corporate employees, Stryker workers operate under a "Bring Your Own Device" (BYOD) policy. To check Microsoft Teams or corporate emails on their personal iPhones, employees were required to download Microsoft Intune's "Company Portal" app. By installing this "work profile," the employee legally grants their company’s IT department administrative privileges over their personal device, ensuring it meets corporate security standards before connecting to the network.

Cybersecurity investigators confirmed that Handala successfully compromised Stryker’s high-level administrator credentials for Microsoft Intune. Because corporate phones are sometimes lost or stolen, Intune has a legitimate, built-in feature called "Remote Wipe" that allows IT to factory-reset a device from afar. Once the hackers gained access to the Intune dashboard, they didn't need to write custom malware for iOS; they simply selected all enrolled devices globally and hit the remote wipe kill switch simultaneously.

Because the Intune command triggers a full Operating System reset, rather than just deleting the Outlook app, the collateral damage to the workforce was devastating. Thousands of workers instantly lost their unbacked-up personal photos, their digital eSIMs (cutting off their cellular service), and access to their Two-Factor Authentication (2FA) apps, locking them out of their personal bank accounts and private emails.

The Stryker hack fundamentally changes the risk calculation for the modern employee. It proves that if you give your employer administrative access to your personal smartphone, you are putting your private data at the absolute mercy of your company's cybersecurity defenses. Security experts are now urging workers to rigidly segregate their devices: keep work tasks strictly on company-issued hardware, and never install an MDM "work profile" on a device that holds your irreplaceable personal data.