WORLDWIDE SHIPPING AVAILABLE
Privacy First logoPRIVACY FIRSTPUTTING YOUR PRIVACY FIRST.

PHONE SECURITY

How to Check Your Phone for Spyware, and How to Stop It Getting On

Most people will never be targeted by Pegasus. But spyware isn't only a problem for journalists and diplomats anymore. Cheap stalkerware apps are sold openly, and the expensive "mercenary" tools keep turning up on the phones of lawyers, activists and business people. This guide covers what these tools can actually do, how they get onto a phone, how to check yours with MVT, and the settings that make you a much harder target.

Diagram of the four ways spyware gets onto a phone: zero-click messages, one-click links, fake apps and physical access, with what helps against each
The four routes spyware takes onto a phone, and the settings that help against each one.

Spyware, malware, stalkerware: what are we talking about?

People use these words loosely, so here's what each one means.

Malware is the broad term for any software built to do something you didn't agree to. Most of it is fairly dumb and opportunistic: fake apps that steal banking logins, adware, or software that signs you up to premium SMS services.

Spyware is malware whose whole job is to watch you. At the top end are commercial products such as NSO Group's Pegasus, Intellexa's Predator and Paragon's Graphite. They're sold to governments, cost serious money per target, and are built to stay hidden.

Stalkerware sits at the other end. These are monitoring apps, often marketed for "keeping an eye on your kids" or "catching a cheating partner", that someone installs on your phone while they have it in their hands. They're far less sophisticated, but for most people they're the more realistic threat.

The difference matters, because the way you protect yourself, and the way you check, depends on which one you're worried about.

What these tools can do once they're on a phone

Modern spyware doesn't bother breaking your encryption. Signal, WhatsApp and every other encrypted app have to decrypt your messages so you can read them, and once spyware has control of the phone, it simply reads them at that point, the same way you do.

Depending on the product and how deep the infection goes, it can:

That last point is the one people miss. Getting rid of the implant is only half the clean-up. If it took your account tokens, you also need to change your passwords and sign out of every session.

The good news, if you can call it that, is that the high-end tools tend to be careful. Many recent Pegasus infections don't survive a restart, because staying on the phone permanently leaves more traces for investigators to find. The attackers would rather re-infect you than get caught.

Who makes these tools

It helps to know the names, because they come up in every news story about this, and because two quite different industries are involved: companies that break into phones remotely, and companies that break into phones someone has physically taken.

NSO Group and Pegasus

NSO Group is an Israeli company, and Pegasus is the reason most people have heard of phone spyware at all. NSO says it sells only to governments, for fighting crime and terrorism. The record says otherwise.

In 2021, a group of 17 media organisations working with Forbidden Stories and Amnesty International published the Pegasus Project. It was built on a leaked list of more than 50,000 phone numbers believed to have been selected as possible targets by NSO's government clients. Amnesty's Security Lab then examined phones belonging to people on the list and found Pegasus infections on the devices of journalists, human rights activists and people close to the murdered Saudi journalist Jamal Khashoggi. MVT is the tool they built to do those checks, and it's the one we walk through below.

The fallout was serious. Later in 2021 the US government put NSO on its Entity List, which restricts American companies from doing business with it. Apple sued NSO the same year (it dropped the case in 2024, saying the risk of exposing its own threat intelligence had become too high). WhatsApp's lawsuit over the 2019 attack ended with a US court finding NSO liable, and in 2025 a jury ordered it to pay damages.

Pegasus is the best known, but it isn't unique. It's just the one investigators have documented most thoroughly.

Predator, Graphite and the rest

The business model is the same across all of them: a paying government client chooses targets, and the vendor supplies the exploits and the infrastructure.

Phone-cracking tools: Cellebrite, Magnet Forensics and others

The second industry doesn't need to reach your phone over the internet. It needs your phone in its hands.

Cellebrite, an Israeli company, is the best-known name. Its UFED and Premium products are used by police, border agencies and militaries around the world to unlock seized phones and copy their contents. Magnet Forensics makes GrayKey, a box built to get into iPhones (it merged with GrayKey's original maker, Grayshift, in 2023), along with AXIOM for analysing what's been extracted. Others include MSAB with XRY, and Oxygen Forensics.

These tools work by guessing the passcode, or by using undisclosed security holes, often in the code that handles the USB connection, to get around the lock screen and the limits on guessing. Depending on the phone and its software version, they can pull out messages, photos, location history, app data and saved passwords. How much they get depends heavily on the phone's state. A phone that has been unlocked at least once since it was last turned on (called AFU, After First Unlock) has its encryption keys loaded in memory and gives far more away than one that has just been restarted (BFU, Before First Unlock).

The companies keep their support lists secret, but some have leaked. Cellebrite documents published in 2024 showed which iPhones and Android phones it could and couldn't get into at the time, and listed fully updated GrapheneOS Pixels among the ones it couldn't. A leaked GrayKey list later the same year showed only partial access to iPhones running the newest version of iOS. Those lists change all the time, so treat them as a snapshot, not a promise.

The line between the two industries isn't as clean as it sounds. In December 2024 Amnesty reported that police in Serbia had used Cellebrite to unlock the phones of a journalist and activists they'd detained, then quietly installed spyware called NoviSpy before handing the phones back. Amnesty also found that a Cellebrite exploit for Android phones relied on undiscovered bugs in USB drivers, which Google then fixed.

This is why some of the advice further down is about physical access: a long passcode, restarting your phone before a situation where it might be taken (a border crossing, a protest, an arrest), and blocking the USB port while the phone is locked.

How spyware actually gets onto a phone

There are really only four routes in. The diagram above sums them up; here's what each looks like in practice.

1. Zero-click: you don't do anything at all

This is the one that makes headlines. The attacker sends something to an app that processes incoming content automatically (a message, an image, a missed call) and a bug in that processing gives them control of the phone. You never tap a thing.

Some real examples:

The pattern is the same every time. The weak spot is the code that handles messages, images and calls from strangers before you've decided whether you want them. Most of the settings further down are about shutting that code off.

2. One-click: a link you're tricked into tapping

Cheaper and still very common. You get a text, email or DM that's written to make you tap: a parcel that couldn't be delivered, a news story about you, a message that looks like it's from your bank. The link opens a web page that exploits your browser.

A nastier version is network injection. In 2023 Citizen Lab showed that an Egyptian politician's phone was redirected to an infection page just by visiting an ordinary website over an unencrypted connection, because the attacker had help from the mobile network. No suspicious link was needed.

3. A fake or rogue app

Mostly an Android problem. The Hermit spyware found in 2022 was spread as fake apps from phone carriers and messaging services, sometimes after the target's mobile data had been deliberately cut off and a text arrived offering an app to "fix" it. Stalkerware is often installed the same way, sideloaded outside the Play Store.

4. Someone with the phone in their hands

The least glamorous route, and by far the most common for ordinary people. A partner, ex, family member or employer has your unlocked phone for a few minutes and installs a monitoring app. At the professional end, police and border agencies use the forensic tools described above, such as Cellebrite and GrayKey, on phones they've seized.

Signs to look for, and why they're unreliable

You'll see plenty of lists online: battery draining faster, the phone running warm, more data use than usual, strange pop-ups. Treat them with scepticism.

Stalkerware can give itself away like this, especially cheaper apps that upload a lot of data. Mercenary spyware is designed not to. A phone infected with Pegasus usually feels completely normal. A flat battery is far more likely to be an app update or an old battery than an implant.

The more useful signals are things like an app you don't remember installing, an app with accessibility or "device admin" access that has no business having it, a configuration profile on an iPhone you didn't add, or a threat notification from Apple, Google or WhatsApp. Apple sends these to people it believes have been targeted by mercenary spyware, and has done so in more than 150 countries. If you get one, take it seriously.

For anything beyond that, you need a proper forensic check.

Checking your phone with MVT

MVT, the Mobile Verification Toolkit, is a free, open-source tool from Amnesty International's Security Lab. It was released in 2021 alongside the Pegasus Project investigation, and it's the same tool researchers use to confirm infections. It works on both iPhone and Android.

MVT isn't an antivirus app, and the difference matters. Instead of scanning for anything suspicious, it collects forensic records from the phone (backups, logs, lists of processes and apps) and compares them against indicators of compromise: the known domains, file names and process names left behind by specific spyware campaigns that researchers have already documented.

That means two things. If MVT finds a match, it's significant. If it finds nothing, that's reassuring but it isn't proof. MVT's own documentation says plainly that public indicators can't confirm a phone is clean, because the newest campaigns won't be in them yet.

What MVT actually looks at

On an iPhone, MVT goes through the records in a backup: your text messages and their attachments, Safari, Chrome and Firefox history, WhatsApp messages, call history, the list of installed apps and configuration profiles, the database of which apps have been given camera, microphone and other permissions, and the records iOS keeps of which processes have used the network. That last one has been key in past Pegasus cases, because the spyware's processes show up there under odd names. It checks links in your messages and browsing history against domains known to have been used in infection attempts.

A sysdiagnose archive adds system logs, including the shutdown log, where researchers at Kaspersky found in 2024 that Pegasus infections leave telltale traces.

On Android, MVT works through what androidqf collects: every installed app (and, if you allow it, a copy of each one so it can be checked against known malicious files), the processes running at the time, system settings such as whether installing from unknown sources or Play Protect has been changed, signs that the phone has been rooted, and the system logs.

Before you start

Install MVT

The simplest way is with pip:

pip3 install mvt

Or, if you use uv:

uv tool install mvt

Then download the latest indicators. MVT checks for new ones itself, but it doesn't hurt to grab them first:

mvt download-iocs

Checking an iPhone

On an iPhone, MVT works from a backup, and it needs to be an encrypted one. Encrypted backups include far more of the records MVT looks at, which is why they're worth the extra step.

  1. Connect the iPhone and make an encrypted backup. On a Mac, use Finder. On Windows, use Apple Devices (or iTunes on older versions). Tick "Encrypt local backup" and choose a password you'll remember. On Linux, idevicebackup2 from libimobiledevice does the same job.
  2. Decrypt the backup into a new folder with MVT:
mvt-ios decrypt-backup -p "your backup password" -d ./decrypted /path/to/backup
  1. Run the check:
mvt-ios check-backup --output ./results ./decrypted

On a Mac, the backup lives in ~/Library/Application Support/MobileSync/Backup/, in a folder named after your phone's ID.

MVT can also read an iPhone sysdiagnose archive (mvt-ios check-sysdiagnose), the diagnostic bundle you can create on the phone itself. It's a handy extra check, particularly if a backup isn't practical.

Checking an Android phone

For Android, the current version of MVT has dropped its old direct-connection command. Data is now collected with a companion tool, androidqf, also maintained by Amnesty's Security Lab, and MVT checks what it collects.

  1. On the phone, turn on Developer options and enable USB debugging.
  2. Download androidqf for your computer from its releases page, connect the phone and run it. Approve the "Allow USB debugging?" prompt on the phone. androidqf will ask you a few questions as it goes, such as whether to include a backup of your SMS, then save everything it collects into an archive on your computer.
  3. Point MVT at what androidqf saved:
mvt-android check-androidqf --output ./results /path/to/androidqf-acquisition

On Android 16, if you've turned on Advanced Protection, the phone can keep intrusion logs, and MVT can check those as well with mvt-android check-intrusion-logs. When you're done, turn USB debugging back off.

Reading the results

MVT writes a JSON file for each thing it checked into your results folder. Anything that matched a known indicator also goes into files with _detected in their name, along with a timeline of events. No _detected files means no known indicators were found.

If something does show up, don't wipe the phone straight away. You'll destroy the evidence someone would need to confirm it. Put the phone aside, use a different device, and get expert help (see below).

Not comfortable with a command line?

MVT is built for researchers, and it shows. If backups and terminals aren't your thing, we've made a web-based version that walks you through the check step by step. Run a spyware scan online.

The same caveat applies to any tool, ours included: it can find known spyware, but a clean result can't prove a phone has never been targeted.

How to make yourself a much harder target

Checking for spyware is useful. Not getting infected in the first place is better. Below is every setting we'd recommend, what it actually changes, and why it gets in an attacker's way. Most of them take a minute.

For everyone, on any phone

On an iPhone: Lockdown Mode

Lockdown Mode is a single switch (Settings, Privacy & Security, Lockdown Mode) that Apple built for people who might be targeted by mercenary spyware. The idea behind it is simple. Zero-click attacks work by finding a bug in some piece of code that runs automatically when something arrives from a stranger. Lockdown Mode switches a lot of that code off, so there's far less for an attacker to aim at.

Here's what it changes, and why each one matters:

It isn't free. Some websites will feel slower or break, you'll miss some attachments, and FaceTime calls from new people won't come through. Still, for anyone who might be a target, it's the single most effective switch on an iPhone, and BLASTPASS showed it stopping a real attack. Turn it on on your iPad and Mac too: it's set per device, and an Apple Watch paired with the phone follows it.

On an iPhone: iMessage, FaceTime and unknown senders

iMessage's job is to accept rich content (photos, files, stickers, links, contact cards, Wallet passes) from anyone who has your number or email, and to process it immediately so it looks nice when you open the chat. That makes it one of the most attractive targets on the phone. Apple has added a lot of protection over the years, including a special sandbox called BlastDoor that unpacks incoming messages in isolation, but FORCEDENTRY found a way around it.

If you don't rely on iMessage, the most thorough option is to turn it off (Settings, Apps, Messages, and switch off iMessage). Messages then fall back to plain SMS. On iOS 18 and later, you can switch off RCS Messaging in the same place too, so messages really are plain text. Do the same with FaceTime (Settings, Apps, FaceTime) if you don't use it. The downside is obvious: no blue bubbles, group chats with iPhone users get messier, and SMS isn't encrypted. If you're turning iMessage off, move your sensitive conversations to Signal.

If you'd rather keep iMessage, turn on Filter Unknown Senders (Settings, Apps, Messages, Unknown Senders). Messages from people who aren't in your contacts go into a separate list, which makes bait messages much easier to spot and ignore.

In WhatsApp

WhatsApp has been used for zero-click attacks at least twice, and with billions of users it will stay a target. These settings make it a much less convenient one:

The same thinking applies to Signal, Telegram and every other messaging app. Wherever an app lets you limit who can contact you, or turn off automatic downloads and previews, do it.

On Android

Going further: a hardened phone

Settings only go so far on a phone whose operating system you don't control. GrapheneOS takes a different approach, rebuilding Android around making exploits harder to pull off rather than just patching them faster:

That isn't a magic shield. No phone is. But every one of these raises the cost of attacking you, and cost is what decides who gets targeted. If you'd like one set up properly, that's what our PF Secured devices are, and you can read how it stacks up in GrapheneOS vs iPhone.

If you think you're being targeted

If MVT flags something, you get a threat notification, or you have good reason to believe someone is going after you, get help from people who do this for a living:

If you're worried about stalkerware from a partner or ex, think about your safety before you remove anything. Deleting a monitoring app can alert the person who installed it. In Australia, 1800RESPECT (1800 737 732) can help you plan, and the eSafety Commissioner has guidance on technology-facilitated abuse.

And whatever you find, change the passwords for your important accounts from a different, trusted device, and sign out of every session you don't recognise.

Frequently asked questions

Can MVT tell me for certain that my phone is clean?

No. MVT compares your phone's records against known traces of documented spyware campaigns. A match is significant, but no match only means none of the known traces were found. New or unpublished campaigns won't show up, which MVT's own documentation points out.

Does a factory reset remove spyware?

It removes most of it, including stalkerware apps and spyware that lives only in memory. It won't undo anything the attacker already took, such as saved passwords or login tokens for your accounts, so change your important passwords from a trusted device and sign out of other sessions as well. Restoring an old backup straight afterwards can also bring back a malicious app.

Does Lockdown Mode stop Pegasus?

Lockdown Mode switches off the features recent iPhone attacks have relied on, such as unusual message attachments, link previews, FaceTime calls from strangers and some complex web code. It blocked at least one real Pegasus exploit, BLASTPASS, in 2023. No setting is a guarantee, but it makes a successful attack much harder.

Is it safe to run MVT on my own data?

MVT runs on your own computer and checks your backup or acquisition locally. Apart from downloading the latest indicators, it doesn't send your data anywhere.

What is the difference between spyware like Pegasus and tools like Cellebrite or GrayKey?

Spyware such as Pegasus, Predator or Graphite is installed remotely, over the internet, and keeps watching the phone while you use it. Forensic tools such as Cellebrite and Magnet Forensics' GrayKey are used on a phone someone has physically taken, usually police or border officers, to unlock it and copy its data at that moment. A long passcode, restarting the phone before it might be seized, and blocking USB data while it is locked are the main defences against the second kind.

Can spyware be installed just by receiving a message?

Yes. These are called zero-click attacks: a bug in the code that handles incoming messages, images or calls lets the attacker in without you tapping anything. WhatsApp's 2019 missed-call attack and the FORCEDENTRY and BLASTPASS iMessage attacks all worked this way. Keeping your phone updated and turning off automatic downloads and previews removes much of that risk.

Shop Hardened Phones →