Mobile phone spyware detection: on-site or remote analysis with PDF report

The mobile spyware detection service offered by ESPIAMOS® analyzes your Android or iPhone using specialized professional equipment. The goal is to identify stalkerware, applications with excessive permissions, suspicious communications, and indicators of compromise associated with commercial and government spyware such as Pegasus . The results are delivered in a technical PDF report .

You can do it in person or remotely , without sending the phone number, which allows you to serve customers throughout Spain and Latin America.

What does mobile spyware detection include?

This isn't about installing an antivirus app on your phone. The analysis is performed with a professional mobile malware scanner that works externally. It checks apps, permissions, system logs, and network traffic.

The service comprises these phases:

• Preliminary interview to find out what makes you suspicious, since when, and who may have had access to the phone.
• Terminal preparation , with clear instructions depending on whether it is Android or iPhone.
• Technical analysis of the device and, where applicable, its network traffic.
• Technical report in PDF format with the results, the level of risk and the indications detected.
• Explanation of the results and recommendations on the next steps.

Detection of government spyware: Pegasus, Predator, and others

Government spyware is the most advanced type of spy software available. Marketed to government agencies, it can take complete control of a phone: messages, calls, microphone, camera, and location. Pegasus is the most well-known example and has appeared in numerous documented cases in Spain and several Latin American countries.

This type of spyware doesn't behave like a conventional spy app. It doesn't appear in the app list and can be installed without the victim clicking any links, through so-called zero-click attacks. Therefore, simply visually inspecting the phone or using an app downloaded from the app store isn't enough.

The team compares the device against the MVT (Mobile Verification Toolkit) database of indicators of compromise. This database includes thousands of domains, processes, and traces associated with known spyware families, including:

• Pegasus
• Predator
• Candiru
• FinFisher
• Hermit
• KingSpawn

When the scan finds a match, the screen and report identify the spyware family, the detected indicator, and the recommended immediate actions. The first of these is to not turn off the device, in order to preserve evidence.

On-site or remote analysis

The method depends on the operating system and the type of analysis you need. In both cases, you keep the phone.

Face-to-face analysis

In the on-site mode, the phone is analyzed in your presence and remains in your line of sight. On Android, this is the only way to perform a full scan of applications and permissions, as it requires a USB cable connection with USB debugging temporarily enabled. Furthermore, it allows you to combine device analysis and traffic capture in the same session.

Remote analysis from Spain or Latin America

Remote analysis eliminates the need for travel and is the standard option for clients outside of Madrid or Spain. It works in two ways:

• iPhone and iPad: You generate a system diagnostic file (sysdiagnose) on your device following our instructions and send it via the channel we specify. The team analyzes this file for indicators of compromise, including those of government spyware.
• Android and iPhone traffic analysis: You receive an invitation to an authorized remote session, also via SMS. A secure connection is established, and while you use your phone normally, the team monitors your communications for anomalous connections or suspicious destinations.

We coordinate the date and time of the session taking into account your time zone.

What gets analyzed on Android and iPhone

Each operating system allows different access. Therefore, the scope of the analysis also varies:

If you're simply trying to determine if your phone is being monitored by an app installed by someone you know, analyzing the device itself is usually the starting point. However, if you suspect a more sophisticated attack, it's advisable to combine device and traffic analysis. Our guide on how to detect spyware on your phone covers the most common warning signs.

The PDF report with the result

Upon completion, you will receive a technical PDF report generated by the team. Its content varies depending on the analysis performed, but it typically includes:

• Session data: date, analysis identifier, duration, and type of analysis.
• An executive summary with the security status and risk score.
• High-risk applications and permissions, in the case of Android.
• The list of contacted domains, with their risk classification, in the traffic analyses.
• Checking against indicators of known government trojans on iPhone.
• Recommendations for action.

The report documents our findings from the analysis. If there are any relevant findings, we'll explain what they mean and what options you have. If you also need a legal assessment of your case, you can request a legal opinion. This is provided independently by a lawyer specializing in electronic countermeasures.

When is it appropriate to request spyware detection on a smartphone?

These are the most frequent situations that lead to requesting the service:

• Someone knows about conversations, messages, or locations that were only on your phone.
• An ex-partner, a family member, or a colleague has had physical access to the terminal.
• Applications, profiles, or permissions appear that you don't remember authorizing.
• You are a journalist, activist, lawyer, politician, or executive, and your activity makes you a potential target of government spyware.
• You are about to start a negotiation or a procedure and you want to know if your communications are secure.

If the suspicion is not limited to the phone, the analysis can be completed with an electronic sweep of offices and rooms or with a TSCM inspection of the vehicle .

Frequently asked questions about detecting spyware on mobile phones

Can I get the analysis done without sending the phone?

Yes. Remote analysis doesn't require sending the device. On iPhones, simply generate and send the diagnostic file. On Android and iPhones, traffic can also be analyzed via a secure remote session. However, a full Android app scan requires an on-site visit.

How long does the analysis take?

The technical analysis usually takes around 30 minutes, plus the time needed to prepare the device. Cases with more specific indications may require a more detailed examination.

Does Pegasus detect on an iPhone?

Yes. Our mobile spyware detection tool compares the device against known indicators of compromise, including those associated with Pegasus and other government-used programs like Predator, Candiru, and FinFisher. If a match is found, the report identifies the spyware family and the detected indicator.

Can an antivirus app detect Pegasus?

Not reliably. On iPhones, apps can't inspect the system or other apps, and government spyware is designed to leave no visible trace. That's why system logs and traffic are analyzed from an external device.

What do I do if the scan detects government spyware?

Do not turn off, restore, or update the phone, as this could cause you to lose evidence. Stop using it for sensitive communications and use another device. We will explain the outcome and the available options for protecting the evidence.

Do I need to erase or restore my phone first?

No. Restoring or updating your phone before the scan can actually remove the traces we're looking for. We recommend not modifying it, and if you suspect it's compromised, contact us from another device.

If you are looking for other counter-surveillance solutions, you can check out the rest of our professional services .