iPhone Malware Scan

End-to-end iOS malware/spyware forensic assessment of a non-jailbroken iPhone from a Mac. Installs tooling (libimobiledevice + Mobile Verification Toolkit), pulls crash logs, creates a full ENCRYPTED device backup (auto-resuming on lock/disconnect), decrypts it, runs MVT against every spyware IOC feed (Pegasus, Predator, Candiru, Cellebrite, Intellexa, stalkerware, ...), sweeps every file in the backup manifest, analyzes crash logs for injected dylibs, and produces an assessment report. Use when the user suspects their iPhone is compromised, asks to check for spyware/Pegasus/stalkerware, or wants a full forensic health check of an iPhone connected over USB.

iPhone malware/spyware assessment

This skill performs a full forensic assessment of a non-jailbroken iPhone connected to a Mac over USB. It is defensive/diagnostic: the user owns the device. All scripts live in scripts/ next to this file.

What it can and cannot do (state this to the user)

• iOS sandboxing means no app can read another app's memory, and mandatory code signing means a foreign dylib cannot be injected into an app without a jailbreak. So "build an app to inspect WhatsApp" is not possible — the real check is a forensic backup scan, which this skill automates.
• MVT matches against known spyware indicators. A clean result is strong evidence but cannot prove the absence of an unknown zero-day. Say this.

Prerequisites

• macOS with Homebrew installed.
• An iPhone + USB cable. The user must unlock the phone, tap Trust, and keep it unlocked and awake during the backup (Auto-Lock → Never).
• A backup password. If backup encryption is not already enabled, this skill turns it on with a password the user provides — capture it and warn them it cannot be recovered if lost.

How to run it

Prefer the orchestrator, driven from this skill folder (scripts/ is alongside this file):

sh

BACKUP_PASSWORD='<user-chosen-password>' \
WORKDIR="$PWD/iphone-assessment" \
  zsh scripts/run-all.sh

The backup and decrypt steps can each take a long time and produce tens of GB. Run long steps in the background and monitor for completion (watch for Manifest.db appearing under WORKDIR/backup/<UDID>/).

Running step by step (when you need control or a step fails)

1. zsh scripts/01-preflight.sh — install/upgrade libimobiledevice + MVT, fetch latest IOCs.
2. zsh scripts/02-pull-crashlogs.sh "$WORKDIR" — pull .ips crash logs (non-destructive).
3. BACKUP_PASSWORD=... zsh scripts/03-backup.sh "$WORKDIR" — full encrypted backup, auto-resumes on lock/disconnect.
4. BACKUP_PASSWORD=... zsh scripts/04-decrypt.sh "$WORKDIR" — decrypt for scanning.
5. zsh scripts/05-scan.sh "$WORKDIR" — MVT check-backup + explicit check-iocs across all feeds.
6. python3 scripts/06-analyze-crashes.py "$WORKDIR/crashlogs" WhatsApp — foreign-dylib / abnormal-kill scan.
7. python3 scripts/07-assess.py "$WORKDIR/mvt-results" --json "$WORKDIR/assessment-summary.json" — final report.

Handling the common failures

• Error Code 208: Device locked during backup → the phone locked. Tell the user to unlock it and set Auto-Lock → Never; step 3 retries automatically.
• Could not receive from mobilebackup2 (-4) → USB dropped / device slept. Reconnect; step 3 resumes from what was already transferred.
• Backup has no Manifest.db → it did not finish; it is unusable for scanning. Re-run step 3 to completion.

Interpreting results (how to report to the user)

• Real IOC match = an entry in a *_detected.json with a non-null matched_indicator. This is the only thing that indicates known spyware. Treat any as serious; direct the user to Amnesty's Security Lab.
• Heuristic notes (e.g. "Lockdown mode disabled") have matched_indicator: null — these are context/hardening advice, NOT detections.
• The assessment (step 7) separates these automatically and prints a verdict, plus the full-manifest file sweep (unknown domains, jailbreak/hook artifacts, dylibs outside app bundles) and a coverage table proving what was examined.

Cleanup

WORKDIR/backup and WORKDIR/decrypted hold the user's personal data and can be very large. Offer to delete them when finished; never delete without asking. The mvt-results/ JSON is small and safe to keep for review.