MEFF M3-PRO Professional Spyware Scanner for Android and iOS Mobile Devices

The MEFF M3-PRO is a professional tool for detecting spyware, Trojans, and malware on Android and iOS phones. It combines three analysis modes in a single portable device: direct inspection of the Android device via USB, analysis of system diagnostic files on iPhones and iPads, and capture of network traffic through its own Wi-Fi hotspot. An offline AI engine interprets the results and generates PDF reports ready to document the findings.

This tool is designed for TSCM technicians, detectives, security departments, and law firms handling cases of espionage, harassment, or data leaks, who need to verify if a mobile phone has been compromised using a reproducible method and a defensible report. This fact sheet explains how it works, what it detects, who it is suitable for, and its limitations.

Table of contents

• Why a spyware detector for mobile phones
• How the MEFF M3-PRO works
  • Analysis of Android terminals via USB
  • iPhone and iPad analysis using sysdiagnose
  • Network traffic analyzer
  • Offline artificial intelligence engine
• Main features
• Reports and documentation
• Who is it for?
• Limitations and considerations
• Frequently Asked Questions
• Conclusion

Why a spyware detector for mobile phones

Installing surveillance software on someone else's phone has never been easier. There are commercial apps available by subscription for a few dozen euros a month that, once installed, allow you to read messages, listen to calls, activate the microphone, or track the phone's location without the owner's knowledge. All it takes is a few minutes of access to the unlocked device.

Faced with this reality, a conventional antivirus falls short: it doesn't inspect for anomalous permissions, background processes, or connections to control servers. Therefore, a professional-grade mobile spyware detector has become as essential a component of a counter-surveillance service as frequency detectors or NLJDs, and it naturally complements electronic sweeps of offices and vehicles.

How the MEFF M3-PRO works

The M3-PRO is not an app that you install on your phone, but a standalone device with a touchscreen, its own Wi-Fi hotspot, and USB-C connectivity. The device to be tested connects to the device or its Wi-Fi network, and the analysis is performed remotely, without installing anything on the phone. It offers three complementary operating modes.

Analysis of Android terminals via USB

With the Android phone connected via USB, the device inspects installed applications, their permissions, background processes, and system behavior in real time. This level of access allows it to identify spyware, stalkerware, Trojans, and high-risk applications that might otherwise go undetected by a standard antivirus app. When it locates a threat, it provides detailed information so the operator can verify it and decide how to proceed.

iPhone and iPad analysis using sysdiagnose

On iOS, it's not possible to inspect the system directly, so the M3-PRO works with the sysdiagnose file, the official diagnostic package generated by the iPhone or iPad itself. The device reconstructs the timeline of the device's activity, examines system logs, and compares patterns with normal behavior to detect signs of advanced spyware. The manufacturer states that a sysdiagnose scan takes about two to three minutes to complete once the file is loaded.

Network traffic analyzer

The third mode doesn't require a wired connection: simply connect the phone to the M3-PRO's Wi-Fi access point. The device captures all outgoing traffic—HTTP, HTTPS, and DNS requests—and displays which domains, IP addresses, and servers the phone connects to. This allows it to detect hidden background connections, DNS anomalies, and communication patterns with command and control (C2) servers used by surveillance software. It's also the most privacy-conscious mode, as it doesn't access the device's contents.

Offline artificial intelligence engine

The results from all three modes are evaluated by an integrated AI engine that operates completely offline : no data from the analyzed phone leaves the device. The AI reviews application behavior, logs, permissions, telemetry, and connections, compares them with known spyware indicators, and explains what it has found and why it considers it a risk, in language understandable even to those without a technical background.

Main features

• Three analysis modes : Android via USB, iOS via sysdiagnose and Wi-Fi traffic capture.
• Detection of spyware, stalkerware, Trojans and malware , including applications with anomalous permissions and connections to C2 servers.
• Integrated offline AI : all analysis is performed on the device itself.
• Updatable threat intelligence database , with indicators of compromise, malware families, IP addresses, and known command and control servers.
• Multilingual PDF reports , with additional export in JSON and CSV.
• AES-256 encrypted storage , password-protected access, and secure deletion of temporary files.
• A compact, self-contained device ready for fieldwork, with a touchscreen, Wi-Fi access point, and USB-C connection.
• Integrated interface and manuals in English, Italian and French, with automatic updates.

Reports and documentation

One of the strengths of the M3-PRO is its document output. Each analysis generates a technical PDF report with device data, detected threats, an explanation of the AI engine, a timeline of events, and grouped evidence, along with a summary in MVT (Mobile Verification Toolkit) format—the open-source tool developed by Amnesty International's security lab for detecting spyware on mobile devices.

This traceability allows the findings to be incorporated into an internal file, a complaint, or an expert report. As with any technical inspection, documenting the discovery and maintaining the chain of custody are part of the methodology taught in our electronic countermeasures training .

Who is it for?

• TSCM technicians and counter-surveillance companies that want to incorporate mobile phone inspection into their sweep services.
• Private detectives who handle cases of partner control, harassment, or non-consensual surveillance.
• Security departments and SOCs that need to check terminals of executives, travelers, or exposed personnel.
• Law firms and journalists who handle sensitive information are common targets of spyware.
• Public bodies and security forces with needs for field analysis and certified documentation.

Limitations and considerations

The M3-PRO detects and reports; the operator manually removes the malware using the information provided by the device. No detection system can guarantee the identification of 100% of threats, especially against constantly evolving state-level spyware, so a negative result reduces the risk but does not eliminate it, and a positive result should be verified before drawing conclusions.

The analysis of a phone should only be carried out on devices owned by the company or with the express consent of its owner, and always within the applicable legal framework. In cases with potential legal implications, It is advisable to seek legal advice from the outset to preserve the evidentiary value of what is found.

The remote analysis function using QR codes, announced by the manufacturer, will be activated on all units using scan packages purchased from the equipment control panel; as of the date of this sheet, it is not available.

Frequently Asked Questions

What differentiates the MEFF M3-PRO from a mobile antivirus?

An antivirus is an application installed on the phone itself, with limited system access and no ability to analyze network traffic. The MEFF M3-PRO is an external device that inspects applications, permissions, processes, logs, and connections from outside the device, interprets the results using AI, and generates a documented report.

Does anything need to be installed on the phone being tested?

No. On Android, it connects via USB; on iOS, it works with the sysdiagnose file generated by the device itself; and traffic analysis only requires connecting the phone to the computer's Wi-Fi network.

Does the phone's data leave the device?

No. The AI engine and all analytics operate offline, storage is encrypted with AES-256, and temporary files are securely deleted. Only license validation and updates use authenticated manufacturer channels.

How long does an analysis take?

According to the manufacturer, analyzing an Android device via USB takes a few minutes, running a sysdiagnose on iOS takes about two or three minutes once the file is loaded, and capturing traffic requires a few minutes of normal use of the phone connected to the access point.

In which languages is it available?

The interface, integrated manuals, and PDF reports are available in English, Italian, and French.

Conclusion

The MEFF M3-PRO fills a gap that radio frequency devices cannot: the phone that the user carries in their pocket. With its three analysis modes, offline AI, and documented reports, it provides counter-surveillance professionals with a technical and traceable response to one of today's most frequent and accessible threats.

We were able to showcase MEFF equipment at our stand at SICUR 2026 ; if you want to assess how the M3-PRO fits into your service or department, consult our technical team or explore the rest of the counter-espionage catalog .