How to Check if Your Phone Has Spyware Like Pegasus

Learn to detect sophisticated spyware on your smartphone using proven security techniques that work against even military-grade surveillance tools. This comprehensive security audit takes 30-45 minutes and requires no technical expertise.

What You'll Need

• Your smartphone (iOS 12+ or Android 8.0+)
• Computer with internet access
• USB cable for your phone
• Mobile Verification Toolkit (MVT) - free open-source tool
• iMazing (iOS users) - $44.99 or free trial
• 30-45 minutes of uninterrupted time

Time estimate: 30-45 minutes | Difficulty: Beginner to Intermediate

Step-by-Step Instructions

Step 1: Document Suspicious Behavior Patterns

Before running technical scans, create a baseline of your phone's current behavior. Open your phone's Settings > Battery (iOS) or Settings > Device Care > Battery (Android). Screenshot your battery usage for the past 7 days.

Advanced spyware like Pegasus operates silently, but it consumes resources. Look for unexplained battery drain, especially during periods when your phone was idle. Any app consuming more than 15% of battery without heavy usage warrants investigation.

Step 2: Check Data Usage Anomalies

Navigate to Settings > Cellular (iOS) or Settings > Connections > Data Usage (Android). Scroll down to see per-app data consumption over the past month.

Spyware transmits your personal data to remote servers, creating unusual data spikes. Flag any system processes or unknown apps using more than 500MB monthly without your knowledge. Pay special attention to apps you rarely use showing high background data activity.

Step 3: Examine Network Activity and Connections

Install Wireshark on your computer and create a mobile hotspot from your phone. Connect your computer to this hotspot, then run Wireshark to monitor all network traffic from your device for 10 minutes of normal usage.

Look for connections to suspicious IP addresses, especially those registered in countries different from your location. Pegasus communicates with command-and-control servers that often use hosting providers in multiple jurisdictions to avoid detection.

Step 4: Run Mobile Verification Toolkit Scan

Download and install Mobile Verification Toolkit (MVT) from Amnesty International's GitHub repository. This is the same tool security researchers use to detect Pegasus infections on journalists' and activists' phones.

For iOS: Connect your phone via USB and run mvt-ios check-backup command. For Android: Enable USB debugging and execute mvt-android check-adb. The scan compares your device's behavior against known spyware indicators of compromise (IOCs).

Step 5: Analyze System Logs for Anomalies

Access your phone's system logs through developer options (Android) or by connecting to a computer running Console.app (macOS for iOS devices). Search for entries containing keywords like "exploit," "injection," or "privilege escalation."

Advanced spyware exploits zero-day vulnerabilities, leaving traces in system logs. According to Amnesty International's forensic methodology, Pegasus infections often generate specific log patterns during the initial compromise phase.

Step 6: Inspect Installed Profiles and Certificates

Navigate to Settings > General > Profiles & Device Management (iOS) or Settings > Security > Device Admin Apps (Android). Document every profile, especially those you don't remember installing.

Malicious profiles grant spyware elevated system access. Any profile from an unknown organization or with broad permissions (camera, microphone, location) requires immediate removal unless you specifically installed it for legitimate purposes.

Step 7: Check for Jailbreak or Root Detection Bypass

Install SkyAlert (iOS) or Root Checker (Android) to verify if your device has been compromised at the bootloader level. These apps detect modifications that spyware uses to gain persistent access.

Even if you never jailbroke or rooted your phone, sophisticated spyware can perform these operations remotely. A positive detection indicates your device's security perimeter has been breached, requiring immediate action.

Step 8: Monitor Background App Refresh and Permissions

Review Settings > Privacy & Security > Location Services and Settings > Privacy & Security > Camera/Microphone. Look for apps with "Always" location access or unrestricted media permissions that you don't recall granting.

Cross-reference this with your app usage data. Apps accessing location, camera, or microphone without corresponding usage in your screen time data likely indicate unauthorized surveillance activity.

Step 9: Verify iOS Backup Encryption Status

For iPhone users, connect to iTunes or Finder and check if backup encryption is enabled without your knowledge. Spyware sometimes modifies backup settings to extract additional data during synchronization.

If backup encryption is enabled with an unknown password, this suggests external modification of your device's security settings. Document this finding as potential evidence of compromise.

Step 10: Run Comprehensive Malware Scan

Install Malwarebytes Security (free for personal use) and perform a full device scan. While consumer antivirus rarely detects military-grade spyware, it can identify related malware or secondary infections.

The scan establishes a clean baseline for future monitoring. Even negative results provide valuable documentation of your device's security status at a specific point in time.

Troubleshooting

Problem: MVT scan fails to complete or shows permission errors.
Solution: Enable Developer Options on Android (tap Build Number 7 times) or trust your computer on iOS. Restart both devices and retry the connection.

Problem: Battery usage data shows system processes consuming excessive power.
Solution: This often indicates kernel-level compromise. Factory reset your device immediately and restore from a backup older than 30 days, as recent backups may contain the infection.

Problem: Network monitoring reveals connections to unknown servers.
Solution: Document all suspicious IP addresses and compare against threat intelligence databases like VirusTotal. Block these IPs at your router level while investigating further.

Expert Tips

• Pro tip: Set up automated screenshots of your battery usage weekly. Spyware infections often show gradual increases in background activity over time.
• Pro tip: Use a separate "burner" Apple ID or Google account for security testing apps to avoid compromising your primary account during investigations.
• Pro tip: Document everything with timestamps and screenshots. If you discover spyware, this evidence may be crucial for law enforcement or legal proceedings.
• Pro tip: Test your phone's behavior on different networks (home WiFi, cellular, public WiFi). Spyware often exhibits different patterns depending on network conditions.

What to Do Next

If you've discovered signs of spyware infection, immediately enable airplane mode and contact a cybersecurity professional. For ongoing protection, implement regular security audits using these techniques monthly. Consider our detailed analysis of Microsoft's recent WhatsApp security warnings to understand the broader threat landscape affecting mobile devices today.

Remember that detecting advanced spyware like Pegasus requires professional forensic analysis in most cases. These steps help identify obvious compromises, but nation-state level surveillance tools continue evolving to evade detection. Stay vigilant and update your security practices regularly.