Is There Spyware on My Phone? Symptoms, Detection, and Digital Forensics

TL;DR: Spyware is no longer just the handiwork of a jealous spouse; it has become a state-level weapon. Tools such as Pegasus, Predator, and Hermit infect with a single tap, or even zero taps, and exfiltrate the entire microphone, camera, and messages. The symptoms include sudden battery drain, overheating, unexpected MFA texts, and the other side knowing things they should not. iOS Lockdown Mode and Google Play Protect are the first line of defense; for definitive detection, a digital forensics laboratory and an MVT scan are essential. On corporate lines, an ISO 27037 compliant examination is expected from the outset.

What Is Spyware?

Spyware is a class of malicious software that, without the user's knowledge, transmits the messages, calls, location, microphone, and camera data on a device to a third party. There are four basic categories:

  1. Commercial "stalkerware": mSpy, FlexiSpy, eyeZy, Cocospy. It is generally marketed as "child tracking" or "employee monitoring," but in practice it is most often seen as a tool of digital abuse between partners.
  2. State-grade tools: NSO Group's Pegasus, Cytrox's Predator, RCS Lab's Hermit. They infect through zero-day vulnerabilities, often without the user doing anything at all.
  3. Open-source RATs: AndroRAT, DroidJack, AhMyth. Low-cost, available on GitHub, modified by "amateur" threat actors.
  4. Banking trojans: Cerberus, ERMAC, Hydra, SharkBot. Although their main purpose is to steal banking credentials, with overlay and accessibility permissions they effectively behave like spyware.

For the rest of the mobile threat landscape, you can take a look at our Turkey Cyber Threat Landscape 2026 article.

The 5 Best-Known Examples

  1. Pegasus (NSO Group): A commercial state spyware, reported many times by Citizen Lab, that infects with zero clicks through iMessage, WhatsApp, and FaceTime. The Citizen Lab archive can be read as a reference for detailed technical reports.
  2. Predator (Cytrox / Intellexa): Developed by the Europe-based Cytrox, a direct rival to Pegasus. Google TAG documented numerous chained vulnerabilities; see the Google Threat Analysis Group.
  3. Hermit (RCS Lab): A spyware produced by the Italian-origin RCS Lab that infects Android and iOS via fake operator redirect pages. Lookout and Google TAG disclosed it together.
  4. mSpy: Commercial stalkerware. Pulling data via Apple ID or iCloud backup access is typical. It has suffered data leaks many times, leaving the victim victimized again.
  5. FinFisher / FinSpy (Lench IT Solutions, Gamma Group): An older European player. Amnesty International's Security Lab has published multiple technical analyses: securitylab.amnesty.org.

Symptoms: Could There Be Spyware on My Phone?

Spyware is designed to hide itself, so expecting "a single piece of evidence" is misleading. The symptoms should be considered under three headings.

Physical Symptoms

  • The battery drains faster than it ever has, and it drops even during hours when you are not using it.
  • The phone heats up even when it is not being used at all, especially the upper part near the earpiece and the camera area.
  • Data usage has increased significantly by the end of the month, even though your usage habits have not changed.
  • It charges quickly, but the battery life has fallen by half while the "screen on" time stays the same.
  • The microphone and camera indicator lights (the orange/green dot on iOS, and a similar one on Android 12 and later) appear from time to time without you using them.

Software Symptoms

  • On iOS, under Settings → General → VPN & Device Management, there is an MDM profile you do not recognize.
  • You receive MFA texts you were not expecting; someone is attempting to sign in to your account.
  • A "new device login" notification appeared on your Apple ID or Google account, but that device is not yours.
  • Unknown apps, especially with generic names like "System Service," "Sync Manager," or "Wi-Fi Helper."
  • URLs you never entered in your browser history; messages in your email folder that were deleted but cannot be found in the "Trash."

Behavioral Symptoms

  • The other side tells you to your face the very subject you discussed only over the phone.
  • The "read" mark on a message you sent on WhatsApp or Telegram never appears, because someone may be reading the message on another device and then marking it as "unread" again.
  • The phone's screen stays open in a different place from where you last left it.
  • Someone close to you knows about a development you did not share on social media.

First Checks You Can Do on Your Own

These are no substitute for a professional examination, but if there is no serious threat, they clear most cases.

iOS

  1. Settings → General → VPN & Device Management: Delete every profile you do not recognize. Never "Trust" a profile other than a corporate MDM.
  2. Settings → Privacy & Security → Microphone / Camera / Location Services: List them and question any app that was active within the last 24 hours.
  3. Settings → Safari → Clear History and Website Data: Tracking cookies are cleared as well.
  4. Turn on Lockdown Mode: The hardening mode introduced with iOS 16+ aggressively restricts message attachment types, web technologies, and invitation surfaces. Official guide: Apple Lockdown Mode.
  5. Update your iOS version and your device model. For Pegasus-like threats, always having the latest patch is the single most critical defense.

Android

  1. Settings → Apps → Special app access → Device admin apps: An unrecognized "device admin" is spyware's main survival method. Disable it and remove the app.
  2. Settings → Apps → Special app access → Accessibility: Anything granted accessibility service permission can read what is on the screen. This is the main vector for banking trojans.
  3. Is Google Play Protect active? Settings → Security → Google Play Protect → "Scan apps with Play Protect" should be on.
  4. Unknown sources: Settings → Apps → Special app access → Install unknown apps. This permission should be granted only to app stores you trust.
  5. Review the apps installed in the last 30 days and delete any with a meaningless name or an unverified publisher.

Definitive Detection: A Digital Forensics Examination

The first checks lower the level of "suspicion," but if there is a legal dispute or a high-profile target, a definitive diagnosis can only be made in a digital forensics laboratory. The process revolves around three types of extraction:

  • Logical extraction: The data the device displays (messages, call logs, contacts). Cellebrite UFED or Magnet AXIOM is used. Source for the Cellebrite product family: cellebrite.com.
  • File system extraction: Application databases, hidden config files, plists.
  • Physical extraction: A raw memory image on devices where it is possible. Advanced examples such as Pegasus reveal the traces they leave only at this level.

On top of these outputs, an artifact scan is performed with Oxygen Forensic Detective or Magnet AXIOM, followed by IOC matching with MVT (Mobile Verification Toolkit). MVT is published as open source by Amnesty International's Security Lab. Commercial pre-scan applications such as iVerify and Trend Micro Mobile Security give an initial idea before going to a laboratory, but they have no forensic validity.

The whole process corresponds, in the field, to the DETECT phase of the NIST Cybersecurity Framework; collection and preservation are carried out with the ISO 27037 chain of custody we detail in our Digital Forensics Process 2026 article.

Citizen Lab's Open-Source Tools

Citizen Lab and Amnesty's Security Lab are the two most publicly open authorities on state-grade spyware analysis. The core tools they provide:

  • MVT (Mobile Verification Toolkit): Performs IOC scanning on an iOS encrypted backup and an Android adb-based dump. It works with STIX 2.1 indicator lists fed by Pegasus, Predator, and Hermit signatures.
  • PegasusChecker-type scripts: Look at specific domains, processes, and file traces.
  • iOS sysdiagnose logging: The diagnostic package Apple provides, scanned by Citizen Lab analysts for anomalous process and crash traces.
  • Published IOC lists: Citizen Lab reports add a new domain, certificate hash, and process name with each finding. These lists are loaded into MVT to keep the analysis current.

All of these tools are designed for volunteer and technical users; the everyday user is not expected to run them, and a digital forensics expert is essential to interpret the output.

State-Grade (Zero-Click) Threats

Zero-click exploits are the pinnacle of the spyware world. The user does not click a link or open a file; it is enough for an iMessage, a WhatsApp message, or an SMS to arrive. Pegasus's FORCEDENTRY chain (CVE-2021-30860) is the classic example; it was decoded by Citizen Lab, and the surface was narrowed with Lockdown Mode following Apple's BlastDoor architecture.

For Predator chains, Google TAG's annual "0-day in the wild" report is the most important publicly available source. These reports show that zero-click exploits were applied against journalist, lawyer, and activist targets in many countries, including Turkey. When a state-grade threat is in play, the thought "I am nobody, why would they target me" is not a defense; in most cases the target is not the main figure but the person in their close circle who can reach them.

Spyware Was Detected, What Should I Do?

If there is a confirmed finding, the first reflex is "let me do a factory reset." This is wrong, because at that moment the only evidence in your hands also flies away. The correct order:

  1. Put the phone in airplane mode, do not turn it off. Turning it off deletes some volatile evidence.
  2. Move the device to a physically safe place and do not share the passcode with anyone.
  3. Turn off iCloud or Google synchronization through a backup account via a web browser, not from the device.
  4. End any suspicious logged-in sessions with "sign out from all devices."
  5. Call a digital forensics expert. The collection procedure must be performed in accordance with ISO 27037; otherwise the evidentiary value will be open to dispute in court.
  6. Prepare a complaint to the prosecutor's office in terms of the Turkish Penal Code, Article 132 (violation of the confidentiality of communications), Article 133 (eavesdropping on conversations between persons), Article 134 (violation of privacy), and Article 135 (recording of personal data).

The Situation on Corporate Lines

Corporate device policy moves between two extremes: a "managed device" fully under corporate MDM control, or BYOD (Bring Your Own Device). Spyware detection works differently in each model.

  • On MDM-managed devices: The organization's own profiles are already installed with permissions similar to "Device Admin." A new profile appearing is seen more quickly, but the fact that corporate profiles can also monitor the phone must be shared transparently with the employee. Otherwise, the KVKK Article 4 principle of good faith comes into play.
  • On BYOD devices: If business correspondence is conducted over a personal line, both the limit of the employer's monitoring is unclear and the threat surface is broad. The CISO's BYOD policy must include a mobile threat defense product (Lookout, Zimperium, Microsoft Defender for Endpoint Mobile) and regular awareness training.

In corporate cases, when an incident is detected, human resources, legal, and the KVKK liaison should speak in the same room alongside the technical triage. It is no longer a decision that IT can make alone.

KVKK and the Legal Framework

In Turkey, spyware gives rise to a double offense, both in criminal law and in data protection law:

  • TCK Articles 132 to 135: The offenses of violating the confidentiality of communications, violating privacy, and recording personal data. The person who installs the spyware is the direct perpetrator.
  • KVKK Article 6: Processing special categories of data such as health, sexual life, biometric data, or religious belief requires explicit consent or an exception provided by law. Because spyware secretly collects data in this category, a violation is certain.
  • KVKK Article 12: The data security obligation. When a leak occurs from an employee device, the data controller's obligation to "ensure an appropriate level of security" comes into question.
  • KVKK Article 28: Exceptions are interpreted narrowly; the "personal/family activity" exception does not cover monitoring another person with spyware.

To follow the decisions published by the KVKK Board, the official address is: kvkk.gov.tr. In spyware cases, the data breach notification must be submitted to the Board within 72 hours of the incident being learned of.

Prevention

  1. Keep iOS Lockdown Mode on at all times for high-risk profiles (journalists, lawyers, senior management, activists).
  2. Keep Google Play Protect on at all times and close the exception for installing from sources other than Google Play.
  3. Approve the installation of an MDM profile only if the IT department instructed you to do so in person.
  4. Use MFA with a hardware key or a TOTP app rather than SMS.
  5. Do not click on uncertain links; especially messages of the "your package could not be delivered" and "information from e-Devlet" type.
  6. Review your iCloud/Google "active devices" list once a month.
  7. Before an old phone trade-in, apply not just a factory reset but a KVKK-compliant permanent erasure procedure.
  8. In messaging apps such as WhatsApp, regularly check the "linked devices" section; if there is a session you do not recognize, your account is in someone else's hands.

FAQ

How can I tell for certain that Pegasus has infected my phone?

It cannot be determined by user symptoms alone. An MVT scan on an iTunes/Finder encrypted backup, followed by log analysis in a digital forensics laboratory, is required. It is confirmed when a match is obtained against Citizen Lab's IOC list.

Does a factory reset clean spyware?

For most commercial stalkerware, yes. However, because some advanced examples such as Pegasus can hook into the firmware and boot chain, they are not always cleaned. Moreover, a factory reset deletes all the evidence that would be used for a legal process.

Is a digital forensics report sufficient for court?

If ISO 27037 compliant collection and a hash-based chain of custody were ensured, yes. Otherwise, the opposing party can have the report rejected on the grounds that "the source could not be verified."

Is there symptomless spyware?

Yes. State-grade tools in particular are designed to minimize battery and data usage so as not to alert the user. "No symptoms at all" does not, on its own, mean you are safe.

My phone was stolen and then returned; should it be scanned for spyware?

Absolutely. Physical access is enough to install a certificate-signed profile or a persistent access tool. A returned device should first go through a digital forensics examination and only then be used.

Are spouse-tracking apps legal?

No. Under Turkish law, installing monitoring software on another person's phone without their consent is an offense and gives rise to administrative sanctions under TCK Article 132 and KVKK Article 6. The "child tracking" exception is limited, for minors, to the framework of the parent's custody rights.

Can I run the MVT tool myself?

Technically yes, but interpreting the output requires digital forensics and mobile threat intelligence experience. A misinterpreted finding can cause a real incident to be overlooked.

Working With DSET

DSET provides the combination of KVKK compliance, a digital forensics laboratory, and mobile spyware detection from a single source. From an individual victim to a corporate CISO, it conducts examinations within the rules of the ISO 27037 chain of custody and delivers the report in a format usable in court. On the Pegasus, Predator, and commodity stalkerware side, we have our own MVT-integrated pipeline.

Our pillar article, Digital Forensics Process 2026, covers all the legal and technical stages of the process. For the threat profile specific to Turkey, our Turkey Cyber Threat Landscape 2026 article is a complementary resource.

Contact: Hacettepe Teknokent, Ankara. Phone: +90 536 662 38 09.

Sources: Citizen Lab, Amnesty International Security Lab, Cellebrite, Apple Lockdown Mode, Google Threat Analysis Group, KVKK.