iPhone Spyware Analyzer

Spyware Detection

iMazing Spyware Analyzer can detect if an iPhone or iPad has potentially been compromised by:

• Pegasus from NSO Group (more info from Amnesty Tech)
• Predator from Intellexa (formerly Cytrox) (more info from Citizen Lab)
• KingsPawn from QuaDreams (more info from Citizen Lab)
• Operation Triangulation from an unknown source (more info from Kaspersky)

Stalkerware/Watchware Detection

In addition, as of May 2023, iMazing Spyware Analyzer can detect dozens of different possible stalkerware and watchware instances that may be running on a device. The full list of such products and services is exhaustive, and can be read here.

Unlike spyware, which is often deployed clandestinely by government-affiliated groups against high-value targets, stalkerware and watchware are commercially developed and distributed. These products are usually positioned as tools for parents to monitor their children, but can potentially be used surreptitiously to monitor others without their knowledge or consent.

⚠ IMPORTANT DISCLAIMER:

iMazing Spyware Analyzer can trigger false-positives, so an indicator of compromise does not necessarily mean your device has been compromised. Learn more below in the FAQ.

---

Frequently Asked Questions

How does iMazing Spyware Analyzer work?

• iMazing scans your entire device for indicators of compromise, which are "breadcrumbs" left behind by an app or action on the device that might indicate unknown activity is taking place.
• iMazing leverages, in part, Amnesty International's open-source Mobile Verification Toolkit (MVT) and uses the same indicators of compromise (STIX files) that are maintained by Amnesty Tech. iMazing downloads these from GitHub.
• iMazing also utilizes these indicators of compromise, many of which are supported by the community, as well as some of our own.

Why should I use iMazing to detect spyware?

• MVT is provided as a command-line tool, and using it requires technical knowledge beyond the scope of most users.
• The MVT project specifically includes this warning: MVT is a forensic research tool intended for technologists and investigators. Using it requires understanding the basics of forensic analysis and using command-line tools. This is not intended for end-user self-assessment. If you are concerned with the security of your device please seek expert assistance.
• While we respect the position of the MVT team and hold their work in high regard, we believe less technical users should be empowered with a solution for using MVT themselves.

Is iMazing Spyware Analyzer free?

• Yes, this feature is free of charge.

Has iMazing ever detected a compromised device?

• iMazing has uncovered between 10 and 100 compromised devices, representing less than 0.005% of iMazing users. (We are deliberately providing such wide a range.)
• With respect to our privacy policy and users, we will never disclose any further details.
• For the purposes of this count: only devices with spyware are considered compromised, not stalkerware or watchware.

Am I at risk?

• The vast majority of people and devices will never be at risk.
• Only you can judge if your life, location, and activities might make you a target.

iMazing has found an indicator of compromise, what next?

• Determine the level of risk: Spyware Analyzer can trigger false-positives.
• For example, just visiting mspy.com in Safari (a benign interaction with a legitimate company, but one that develops watchware) will trigger an alert when iMazing's Spyware Analyzer scans your Safari data that your device might be associated with mSpy. If that is the only indicator of compromise iMazing reports, it’s unlikely that your device actually has mSpy installed on it.
• Examine the timing: if the indicator of compromise is many-years old, it is likely a false-positive or suggests a previous (but not active) compromise.

If Spyware Analyzer indicates compromise by spyware (Pegasus, Predator, KingsPawn), we advise you to contact:

• If you are a human rights defender, journalist, or from a civil society organization: Amnesty Tech (Please note that their mandate does not cover providing assistance to ordinary individuals, governments, or companies.)
• If a business or government device is compromised: the appropriate security liaison at your enterprise, department, or agency
• Local law enforcement
• Important: We are unable to directly help you beyond this. Although we are happy to discuss your specific situation or circumstances and review your results, it is unlikely that we'll be able to assist you beyond what is written on this page.

My iPhone or iPad has been compromised, how can I remove the spyware?

• Spyware Analyzer is only capable of detecting indicators of compromise, not removing them.
• If the indication is many-years old, the chances are high that it is either a false-positive or that the exploit used to compromise your device has already been patched by Apple with an iOS or iPadOS update.
• Please note: Apple shares limited information about patched exploits; determining whether an exploit that may have compromised your device has been fixed is practically impossible.
• If you are concerned about having been compromised, we advise you to:
  • Consider replacing the device completely.
  • Not restore from a backup, since the backup may be compromised.
  • Consider changing your SIM/eSIM number.

---

Learn more:

• iMazing Guide: Detect Pegasus and Other Spyware on iPhone and iPad
• 2023 May Blog: Spyware Analyzer Improvements
• 2021 Aug Blog: Detecting Pegasus Spyware with iMazing
• Amnesty International Security Lab
• Amnesty International's Technical Investigations - Indicators of Compromise (STIX files)
• About the Pegasus Project [Unofficial]
• NSO Group
• NSO Group CEO Interview - WSJ January 2023