Cracked Copies of XRY Pro, a Police Phone-Cracking Tool, Are Being Sold for $10

What MSAB Says Happened

According to MSAB’s statement, “a third party was able to circumvent MSAB’s licensing system and copy the software” after a cyberattack on “a legitimate MSAB customer”. The breach happened at the customer’s premises, and MSAB says its own security procedures were not compromised. It has not named the customer or its country. The same third party also distributes copies of tools from MSAB’s competitors, the company says, without naming them.

CFO Tony Forsgren confirmed to Affärsvärlden that cracked versions were being sold through Telegram, and said that, as far as the company can see, no exploitation technique has been revealed. When the magazine reported the $10 offers on November 5, CEO Peter Gille said it “feels unfortunate”.

Listings on cracked-software sites name XRY Pro builds 11.5.5 and 11.5.6. MSAB released the 11.5 line in June 2026, and its newest release came out on October 22. Whether the copies work as the sellers claim is not confirmed.

MSAB also says the incident has “no commercial impact”, because its customers would not buy illegal copies. That is probably true. The people with something to lose are not MSAB’s customers, but the owners of the phones these copies may be used on.

Why a $10 Copy Matters

XRY Pro is what MSAB calls “our most advanced extraction tool”. Its product page promises to “bypass passwords on AFU (After First Unlock) devices” and “brute-force locked BFU (Before First Unlock) devices”, with what it calls unique brute-force and extraction exploits. It runs on Windows, and MSAB requires current XRY certification before a customer can get it.

Normally, MSAB decides who buys. It stopped selling to Russia and China, and it does not sell to Myanmar because of an EU export ban, the company told SVT in 2021. Sold the legitimate way, its tools have still been used against activists. In 2020, Hong Kong police used XRY to get into the locked iPhone of democracy activist Joshua Wong, according to a court document he posted.

MSAB’s statement admits the copies may now reach “parties to whom the company would not normally sell”. At $10, that can mean almost anyone with a Windows PC.

It is not the first leak. In January 2023, the hacktivist group Enlace Hacktivista and the transparency collective DDoSecrets published 103 GB of MSAB software and documentation, together with 1.7 TB from its Israeli rival Cellebrite. This time, by MSAB’s own account, the licensing check itself was bypassed, and the copies are sold.

“None of MSAB’s proprietary technology has been compromised; only the licensing system has been circumvented,” the company says. The copies, though, are of the program itself, and users on the GrapheneOS forum are already suggesting taking one apart to learn which phone vulnerabilities it uses. It has happened before. In 2021, Signal’s founder Moxie Marlinspike analysed a Cellebrite kit and showed that its software could be attacked through a specially made file on a scanned phone. Such work cuts both ways. What researchers find, phone makers can fix.

Privacy advocates have warned for years that tools built to break into phones do not stay with the buyers they were made for. Now that warning has a price, and it is $10.

What You Can Do

Tools like XRY work on a phone that someone holds in their hands and connects to a computer. They are not remote hacking tools. So the risk is a lost or stolen phone, someone with access to it, or an authority MSAB would not sell to.

• Install updates. MSAB itself says updates from phone makers “will render the copied version obsolete within a few months”. That only helps phones that still get them. An old phone without security updates keeps whatever holes the copy uses.
• Use a long passcode. Brute force means guessing. A long passcode with letters and numbers takes far more guesses than a six-digit PIN.
• Let the phone restart, or switch it off. MSAB’s own product page shows why: a phone unlocked once since it started (AFU) can be bypassed, while one that has not been unlocked since it started (BFU) has to be brute-forced. iPhones restart by themselves after three days locked, a feature Apple added in iOS 18.1 (TechCrunch). Android phones with Google Play services do the same after three days locked since Google Play services 25.14 in April 2025 (Android Authority). GrapheneOS reboots a locked phone after 18 hours by default. If you expect to lose control of your phone, for example before a border check, turn it off.