<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: detecting-mobile-spyware
description: >-
  Detect and analyze mobile spyware including stalkerware, commercial
  surveillance tools, and state-sponsored implants through permission
  analysis, behavioral indicators, network traffic patterns, and runtime
  monitoring using Frida, MVT, and forensic acquisition tools.
domain: cybersecurity
subdomain: mobile-security
tags:
  - spyware
  - stalkerware
  - surveillance
  - mvt
  - pegasus
  - forensics
  - frida
  - indicator-detection
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1426", "T1430", "T1429", "T1417"]
  owasp-mobile: ["M1", "M8"]
  tools: ["mvt", "frida", "androguard", "adb", "idevicebackup2"]
---

# Detecting Mobile Spyware

## Overview

Mobile spyware silently collects location data, messages, call recordings,
photos, and keystrokes. Stalkerware targets individuals (domestic abuse
scenarios), while commercial spyware like Pegasus and Predator targets
journalists and activists. Detection requires examining installed packages,
permission abuse, background services, network beacons, and filesystem
artifacts across both Android and iOS.

## Prerequisites

```bash
pip install mvt frida-tools androguard
# MVT (Mobile Verification Toolkit) by Amnesty International
# https://github.com/mvt-project/mvt

# iOS backup extraction
brew install libimobiledevice
pip install iOSbackup
```

## Workflow

### Step 1: MVT Automated Scan

```bash
# Android — scan ADB backup
adb backup -all -f android_backup.ab
mvt-android check-backup android_backup.ab -o mvt_results/ -i iocs.stix2

# Android — check installed packages
mvt-android check-adb -o mvt_results/ -i iocs.stix2

# iOS — scan iTunes backup
mvt-ios check-backup --input backup_dir/ -o mvt_results/ -i iocs.stix2

# iOS — check filesystem dump
mvt-ios check-fs --input fs_dump/ -o mvt_results/ -i iocs.stix2

# Download latest IOCs from Amnesty
wget https://raw.githubusercontent.com/AmnestyTech/investigations/master/2021-07-18_nso/pegasus.stix2
```

### Step 2: Permission and Package Analysis

```bash
# Android — enumerate suspicious packages
adb shell pm list packages -f | sort
adb shell pm list packages -3  # third-party only

# Check for packages with excessive permissions
for pkg in $(adb shell pm list packages -3 | cut -d: -f2); do
  echo "=== $pkg ==="
  adb shell dumpsys package "$pkg" | grep -E 'permission|granted=true'
done

# Spyware permission profile
adb shell dumpsys package com.suspect | grep -E \
  'ACCESS_FINE_LOCATION|RECORD_AUDIO|CAMERA|READ_SMS|READ_CALL_LOG|READ_CONTACTS'

# Check for device admin apps
adb shell dumpsys device_policy | grep 'admin='

# iOS — check for unusual profiles
ideviceprovision list
ideviceinstaller -l  # list installed apps
```

### Step 3: Background Service Analysis

```bash
# Android — running services
adb shell dumpsys activity services | grep -E 'ServiceRecord|intent'
adb shell dumpsys alarm | grep -B2 -A2 'com.suspect'

# Check for persistent boot receivers
adb shell dumpsys package com.suspect | grep -A5 'receiver'

# Monitor battery drain (spyware indicator)
adb shell dumpsys batterystats | grep -A10 'com.suspect'

# Frida — monitor background operations
frida -U -f com.suspect.app -l monitor_background.js --no-pause
```

### Step 4: Network Beacon Detection

```bash
# Capture traffic from suspect device
tcpdump -i any -w spyware_traffic.pcap &

# Analyze C2 patterns
tshark -r spyware_traffic.pcap -Y 'dns' -T fields \
  -e dns.qry.name | sort | uniq -c | sort -rn

# Check for known spyware infrastructure
tshark -r spyware_traffic.pcap -Y 'tls.handshake' -T fields \
  -e tls.handshake.extensions_server_name | sort -u

# Look for periodic beacons (fixed intervals)
tshark -r spyware_traffic.pcap -Y 'ip.dst==SUSPECT_IP' -T fields \
  -e frame.time_relative | awk '{printf "%.0f\n", $1}'
```

### Step 5: Filesystem Artifact Analysis

```bash
# Android — check data directories for spyware artifacts
adb shell ls -la /data/data/ | grep -v com.android | grep -v com.google
adb shell find /sdcard/ -name '*.log' -o -name '*.dat' -newer /sdcard/DCIM 2>/dev/null

# Check for hidden recording files
adb shell find /sdcard/ -name '*.3gp' -o -name '*.amr' -o -name '*.mp4' 2>/dev/null

# iOS — check for Pegasus indicators
find backup_dir/ -name 'com.apple.CrashReporter' -exec ls -la {} \;
find backup_dir/ -name '*.binarycookies' -exec strings {} \; | grep -i pegasus
sqlite3 backup_dir/sms.db "SELECT * FROM message WHERE is_read=0 LIMIT 20;"
```

## Detection Opportunities

| Signal | Source | Description |
|--------|--------|-------------|
| Excessive permissions | Package manager | Location + audio + camera + SMS |
| Hidden packages | Package list | No launcher icon, generic names |
| Periodic beacons | Network capture | Fixed-interval C2 connections |
| Battery drain | Battery stats | Unusual background power use |
| Device admin | Device policy | Unexpected admin privileges |
| MVT IOC match | MVT scan | Known spyware indicators found |

```yaml
title: Mobile Spyware Detection
id: 2386d8b7-17c5-4321-9784-53504f3158a4
status: experimental
description: Detects suspicious activity related to detecting mobile spyware techniques in mobile security context
logsource:
  category: application
  product: android
detection:
  selection:
    EventType: error
  condition: selection
level: medium
tags:
  - attack.t1426
  - attack.t1430
  - attack.t1429
  - attack.t1417
  - attack.initial_access
falsepositives:
  - Mobile device management platform enforcing security policies
```

## Verification

- [ ] MVT scan completed with latest IOCs
- [ ] Package permissions audited for abuse patterns
- [ ] Background services and boot receivers inspected
- [ ] Network traffic analyzed for C2 beacons
- [ ] Filesystem artifacts checked for surveillance data
- [ ] Device admin and profile configuration reviewed

## References

- [MVT — Mobile Verification Toolkit](https://github.com/mvt-project/mvt)
- [Amnesty International — Pegasus Project](https://www.amnesty.org/en/latest/research/2021/07/forensic-methodology-report-how-to-catch-nso-groups-pegasus/)
- [MITRE T1430 — Location Tracking](https://attack.mitre.org/techniques/T1430/)
- [Coalition Against Stalkerware](https://stopstalkerware.org/)
