WORLDWIDE SHIPPING AVAILABLE
Privacy First logoPRIVACY FIRSTPUTTING YOUR PRIVACY FIRST.

PHONE SECURITY

MVT (Mobile Verification Toolkit): How to Check an iPhone or Android for Spyware

Published 25 October 2026

Close-up of colourful source code on a dark computer screen

MVT, the Mobile Verification Toolkit, is the free, open-source tool that Amnesty International's Security Lab released in July 2021 to confirm Pegasus infections during the Pegasus Project. It checks records from an iPhone or Android phone for the known traces of specific spyware. It's powerful, but it's a research tool, and the way you use it, especially on Android, has changed recently.

This guide walks through the current steps, as documented at docs.mvt.re in October 2026, and explains what the results can and can't tell you. For the bigger picture on spyware and how to avoid it, start with our guide to checking your phone for spyware. For background on the spyware MVT was built to find, see What is Pegasus spyware?

What MVT is, and what it isn't

MVT isn't an antivirus app. It doesn't look for anything that seems suspicious. It does two separate jobs:

  1. Extraction. It pulls structured records out of a phone backup or acquisition: messages and the links in them, browser history, installed apps, configuration profiles, app permissions, process and network usage records.
  2. Comparison. It checks those records against indicators of compromise (IOCs): domain names, process names, file names and hashes, app IDs and similar traces left by spyware campaigns that researchers have already documented.

The indicators come as STIX2 files, a standard format for sharing threat intelligence. MVT's built-in download command fetches the project's public collection, which includes Amnesty's indicators for Pegasus and Predator, and a separate set for Android stalkerware.

Two points from MVT's own documentation are worth knowing before you start:

That doesn't mean you shouldn't run it. It means you should read the result the right way.

What you need

The documentation now recommends installing MVT with pipx, which keeps it in its own isolated environment: pipx install mvt. Then download the latest public indicators with mvt download-iocs. MVT loads them automatically on every check from then on.

Checking an iPhone

On an iPhone, MVT works from a backup, and that backup should be encrypted. Encrypted backups include records that unencrypted ones leave out, such as Safari history, call history and the shutdown log.

1. Make an encrypted backup

You have two options:

Keep the phone unlocked while the backup runs. On a Mac, Finder stores backups in your user Library under Application Support/MobileSync, in a folder named after the phone's unique ID (UDID).

2. Decrypt it

MVT needs a decrypted copy to read. The command is mvt-ios decrypt-backup, with -d for the folder to put the decrypted copy in, followed by the path to the backup. It will ask for the backup password. If you'll be decrypting the same backup more than once, mvt-ios extract-key saves the decryption key to a file instead. Treat that file like the password.

3. Run the check

Run mvt-ios check-backup with --output pointing at an empty results folder, followed by the path to the decrypted backup. MVT runs each of its modules in turn and writes one JSON file per module, such as sms.json or tcc.json (the app permissions database).

Later, when new indicators are published, you don't need a fresh backup. mvt-ios check-iocs re-checks the results folder you already have against the updated indicators.

Checking an Android phone

Android is where MVT has changed the most, and where it can see the least.

Direct ADB checks are gone. Older guides tell you to run mvt-android check-adb. The MVT documentation now says the ability to analyse Android devices directly over ADB has been removed, because it produced inconsistent results. Collection is now done with AndroidQF (Android Quick Forensics), a companion tool maintained by Amnesty's Security Lab.

1. Collect with AndroidQF

  1. On the phone, enable Developer options and turn on USB debugging.
  2. Download AndroidQF for your computer from its GitHub releases page. It's a single standalone program, with no Python needed.
  3. Connect the phone, run AndroidQF and approve the "Allow USB debugging?" prompt on the phone.
  4. Answer AndroidQF's questions as they come up, such as whether to back up your SMS messages and whether to copy all apps or only non-system ones. It saves everything into an archive in the current folder.

AndroidQF collects the list of installed packages, running processes, system settings, system properties, logs, diagnostic output, and a bugreport, Android's own diagnostic bundle.

2. Run the check

Run mvt-android check-androidqf with --output for a results folder, followed by the path to what AndroidQF saved. It also checks any SMS backup inside the acquisition.

Android Intrusion Logs

If the phone has Google's Advanced Protection turned on, with the optional Intrusion Logging feature enabled, Android keeps encrypted logs of DNS lookups, network connections, process starts and ADB activity. The feature arrived for Android 16 in May 2026. AndroidQF will offer to download and decrypt those logs, and check-androidqf analyses them automatically. MVT's documentation calls this the recommended Android workflow. The catch is that logging has to be switched on before anything happens: it can't be turned on after the fact.

Why Android results are thinner

MVT's documentation is candid about this. Android provides fewer forensically useful records than iOS, backups contain little, and bugreport files vary in format between Android versions and manufacturers. That's why most confirmed Pegasus cases involve iPhones. Android phones aren't safer; there's just less evidence to find.

Reading the results

How to read each outcome:

ResultWhat it meansWhat to do
A match against Pegasus or Predator indicatorsSerious. Treat it as a likely compromise until an expert says otherwiseStop using the phone for anything sensitive, don't reset it, and get expert help
A match against stalkerware indicatorsSomeone may have installed a monitoring appThink about your safety before removing it (see below)
No matchesNone of the published traces were foundReassuring, not proof. Keep updating, restarting and re-checking with new indicators

If something matches, don't factory reset the phone straight away. You'd wipe the evidence an investigator needs. Use a different device and get help.

Privacy: what leaves your computer

MVT runs on your own computer, and your backup is analysed there. A few things do touch the network:

The easier option: our in-browser scanner

MVT assumes you're comfortable with Python and a terminal. If you're not, our free spyware scanner runs MVT's own checks and published indicators inside your web browser, with no install and no account.

Everything happens in your browser tab. The phone's data, your backup password and the report aren't sent to us or anyone else, and you can switch off Wi-Fi once the page has loaded. It's our unofficial port, not an Amnesty product, and it has the same limit as MVT: a clean result can't prove a phone has never been targeted. The scanner page explains exactly what it checks. Prefer the official desktop tools, or need AndroidQF's extra collection on a rooted phone? Use AndroidQF and MVT directly, as described above.

When to get expert help

Get help, rather than relying on a self-check, if MVT or our scanner flags something, if you get a threat notification from Apple or WhatsApp, or if your work makes you a likely target.

If you think a partner, ex or family member is monitoring your phone, removing an app can alert them. In Australia, 1800RESPECT (1800 737 732) can help you plan safely, and the eSafety Commissioner has guidance on technology-facilitated abuse.

After the check

Checking is only half of it. Restarting regularly clears spyware that lives only in memory and puts the phone back into its most locked-down state (see AFU vs BFU), and our phone privacy checklist covers the rest. If you want a phone designed to make exploits harder in the first place, read GrapheneOS vs iPhone or see our PF Secured GrapheneOS phone.

Privacy First sells GrapheneOS phones and makes the free in-browser spyware scanner described above. It is not affiliated with Amnesty International or the MVT project.

Run a free spyware check→

← Back to Blogs