Otkrivanje stalkerwarea, spywarea i skrivenog pristupa na telefonima¶

Sumnja da netko potajno čita vaše tekstualne poruke, sluša vaše telefonske pozive, prati vašu GPS lokaciju u stvarnom vremenu ili prati svaki pritisak na tipku koju tipkate na svom iPhoneu ili Android pametnom telefonu hitna je kriza osobne sigurnosti i digitalne sigurnosti. Međutim, prije nego što izbrišete bilo koju sumnjivu aplikaciju ili promijenite jednu zaporku na svom telefonu, morate razumjeti dvije ključne činjenice o modernom nadzoru putem pametnog telefona. Prvo, rizik od fizičke eskalacije je stvaran: u situacijama zlostavljanja u obitelji, prisilne kontrole ili uhođenja, brisanje stalkerware aplikacije (mSpy, FlexiSPY, Cocospy, Hoverwatch, uMobix, Eyezy, ili KidsGuard) or cutting off location sharing sends an instant disconnection alert to the abuser's dashboard, which can trigger immediate physical retaliation. Second, 90 percent of modern smartphone spying is NOT an invisible "Hollywood hacker virus" installed over the internet, instead, it is done by someone who knew or guessed your 4-to-6-digit phone passcode, logged into your Apple iCloud / Google Account on another device, scanned your WhatsApp / iMessage / Signal Linked Devices QR code, enabled Android Accessibility / Device Admin sideloaded stalkerware, or placed your phone on a Shared Family Plan / MDM Profile.

If you are in immediate physical danger from a partner, stalker, or intruder right now, call your local emergency number (911 u Sjedinjenim Državama i Kanadi, 112 diljem Europske unije, 999 in the United Kingdom) from a safe telephone or consult our directory of international hitne brojeve. If you suspect your current phone is being monitored by an abusive partner or stalker, read Step 1 below before changing any settings on that device.

Učinite to sada¶

1. Assess your physical safety BEFORE removing stalkerware or revoking account access: If an abusive partner, ex-partner, or stalker is monitoring your phone, wiping the device or kicking them out of your iCloud/Google account immediately alerts them that you have discovered the surveillance. If removing access could put you in physical danger, leave the monitored phone exactly as it is so it continues showing normal, boring activity, and buy a separate, cheap prepaid "Safe Phone" (Burner Phone) paid for with physical cash at a supermarket or pharmacy to call domestic violence shelters, attorneys, family, or police.
2. Never set up a new "Safe Phone" on your home Wi-Fi or link it to your old Apple ID, Google Account, or phone number: Keep your Safe Phone completely disconnected from your old digital life, create a brand-new Apple ID or Google Account with a fictional name, never connect it to your home Wi-Fi router (which logs connected device MAC addresses and hostnames), keep Bluetooth and Location Services turned off when not needed, and never call or text your old phone number from the Safe Phone.
3. If it is safe to lock down your current iPhone right now, run Apple's built-in Safety Check (Settings -> Privacy & Security -> Safety Check): Introduced for iOS 16, 17, and 18+, Safety Check provides a one-button Emergency Reset that immediately stops all Find My location sharing with everyone, resets privacy permissions (microphone, camera, photos, location) across all apps, restricts iMessage and FaceTime strictly to the single iPhone in your hand, and helps you remove unfamiliar devices from your Apple Account and change your passcode.
4. Check for "Zero-Install" Cloud & Messaging Mirroring (iCloud Devices, Google Find My Device, and WhatsApp Linked Devices): Before hunting for hidden spy apps, check the 3 places where 85 percent of real-world snooping happens:
   • WhatsApp / Signal / Telegram: Open Settings -> Linked Devices. If you see a Google Chrome (Windows/Mac) ili Safari session you do not recognize, tap it and click Log Out immediately, someone scanned your QR code while you were asleep or in the shower and has been reading every message live on their laptop.
   • Apple iCloud / Google Account Device List: Check Settings -> [Your Name] on iPhone (scroll to the bottom) or myaccount.google.com/device-activity on Android to see if an old iPad, spare iPhone, or desktop computer is logged into your cloud account syncing your photos, texts, and live GPS location.
5. On Android, run a Google Play Protect scan and audit Accessibility Services, Device Admin Apps, i Notification Access: Unlike iPhones (which block sideloading outside specific regions), an attacker with 3 minutes of physical access to your unlocked Android phone can disable Google Play Protect, download an .APK stalkerware installer (disguised in your app list as System Update, Settings, Wi-Fi Service, ili Device Health), and grant it full screen-reading Accessibility and Notification Listener permissions.
6. Before wiping a phone, take forensic screenshots or photos of the spyware with a second camera for law enforcement and family court: Installing stalkerware or intercepting private electronic communications without consent is a serious felony in the United States (Federal Wiretap Act, 18 U.S.C. § 2511 and CFAA, 18 U.S.C. § 1030), the United Kingdom (Computer Misuse Act 1990), Canada (Criminal Code s. 184 i s. 342.1), the European Union, and Australia. Before factory-resetting your phone, use a different phone's camera to photograph the unfamiliar Linked Devices, suspicious .APK permissions, and Account Login logs as admissible evidence for a restraining order or criminal prosecution.

Decision tree: diagnosing how your phone is being monitored¶

Use this technical triage flowchart to distinguish between Cloud/Account Mirroring, Commercial Stalkerware (.APK / MDM), Cellular Carrier Family Tracking, and Advanced Exploit Spyware:

flowchart TD
    A["Suspected Phone Surveillance: Texts Read, Calls Known, or Live Location Tracked"] --> B{"Is it physically safe to cut off the stalker's access right now?"}
    B -->|"No: Abuser is in the home or may retaliate violently"| C["Do NOT alter the monitored phone. Acquire a Cash-Purchased Prepaid Safe Phone on a Separate Cellular Network"]
    B -->|"Yes: Safe to audit and purge surveillance"| D{"What operating system does the phone run?"}
    D -->|"Apple iPhone (iOS)"| E["1. Run iOS Safety Check (Settings -> Privacy & Security -> Safety Check)"]
    E --> F["2. Check Settings -> General -> VPN & Device Management for MDM Profiles or Configuration Certificates"]
    F --> G["3. Audit WhatsApp/Signal Linked Devices, AirTag/Find My Alerts & Shared Mobile Carrier Account"]
    G --> H{"Do you suspect Zero-Click Nation-State Mercenary Spyware (Pegasus / Predator)?"}
    H -->|"Yes (Journalist, Dissident, Executive, High-Risk Target)"| I["Enable iOS Lockdown Mode, Reboot Daily, Capture Sysdiagnose & Scan with MVT (Mobile Verification Toolkit)"]
    H -->|"No (Domestic / Stalkerware Scenario)"| J["Change Device Passcode (6+ Digit Alphanumeric), Change Apple ID Password, Enable 2FA & Factory Reset if Jailbroken"]
    D -->|"Android (Samsung, Pixel, Motorola, etc.)"| K["1. Turn On Google Play Protect (Play Store -> Profile -> Play Protect -> Scan)"]
    K --> L["2. Audit Settings -> Accessibility, Device Admin Apps, Notification Access & Appear on Top"]
    L --> M["3. Audit WhatsApp/Google Messages Web Pairing (`messages.google.com/web`) & Google Location Sharing"]
    M --> N["Photograph Evidence with Second Camera, Back Up Only Plain Photos/Contacts, and Execute Full Factory Reset"]

Understanding the 4 tiers of mobile surveillance (How did they get in?)¶

When someone knows exact details from your private conversations or knows everywhere you drove today, it is easy to panic and think they have supernatural hacking abilities. In reality, smartphone surveillance falls into four concrete technical categories, and over 95 percent of domestic, relationship, and workplace cases are Tier 1, Tier 2, or Tier 3:

Phase 1: Complete step-by-step iPhone (iOS / iPadOS) spyware & stalkerware audit¶

Apple's iOS operating system enforces mandatory hardware-verified code signing and strict app sandboxing. An App Store app cannot secretly read your text messages, record your phone calls, or log your keystrokes outside its own app. Therefore, if someone is spying on your iPhone (assuming it is not visibly Jailbroken and you are not a target of a million-dollar government agency), they are using one of the seven specific iOS mechanisms below. Check every single one in order:

1. Run Apple Safety Check (iOS 16, 17, 18+)¶

1. Open Settings -> Privacy & Security -> scroll to the bottom and tap Safety Check.
2. Tap Manage Sharing & Access (if you want to inspect exactly who has access before cutting it off, so you can photograph it as evidence) OR tap Emergency Reset (to immediately cut off all sharing at once).
3. Inside Manage Sharing & Access, iOS shows you a unified forensic list of:
   • Every person you are sharing your Find My Location, Shared Photo Albums, Shared Calendars, Shared Notes, Shared Reminders, HomeKit Home, and Health Data with.
   • Every Shared Password (AirDrop / Passwords Family Sharing) group.
   • Every device signed into your Apple ID.

2. Inspect Settings -> [Your Name] for Secret Mirroring Devices (The "Hidden iPad" Trick)¶

1. Open Settings and tap [Your Name / Apple Account] at the very top.
2. Scroll all the way to the bottom to view your Device List.
3. What to look for: Look at every single iPhone, iPad, Mac, Apple Watch, or Windows PC listed. A very common domestic surveillance tactic is for a partner to take an old iPad or spare iPhone, sign it into your Apple ID using your phone passcode while you are asleep, turn off notifications on that iPad, and hide it in a drawer or briefcase. That hidden iPad receives every single iMessage, SMS (via Text Message Forwarding), photo, and live Find My ping in real time.
4. Dodirnite bilo koji uređaj koji trenutačno fizički ne držite u svom posjedu i dodirnite Ukloni s računa.
5. Zatim idite na Postavke -> Aplikacije -> Poruke -> Prosljeđivanje tekstualnih poruka (ili Settings -> Messages -> Text Message Forwarding) and turn OFF any Mac or iPad listed there so standard green-bubble SMS texts are not mirrored to another screen.

3. Provjerite Roguea MDM (Mobile Device Management) Profiles and Root Certificates¶

While ordinary apps cannot spy on an iPhone, an enterprise Configuration Profile (.mobileconfig) ili Mobile Device Management (MDM) profil, ili prilagođeni Root TLS Certificate, omogućuje administratoru usmjeravanje vašeg internetskog prometa kroz proxy poslužitelj, praćenje lokacije uređaja i provjeru kriptiranog web prometa.

1. Otvorite Postavke -> Općenito -> pomaknite se prema dolje i dodirnite VPN & Device Management.
2. Što bi trebalo biti ovdje: Osim ako vaš iPhone nije u vlasništvu vašeg poslodavca ili škole, pod Mobile Device Management ili Configuration Profiles trebalo bi biti instalirano NULA profila (samo vaša normalna korisnička VPN aplikacija ako ste je osobno instalirali kao što je ProtonVPN ili Mullvad).
3. Ako vidite nepoznati MDM profil, "Roditeljska kontrola / Obiteljski profil" ili "Analytics / Beta profil" koji niste instalirali, fotografirajte ga drugom kamerom i dodirnite Ukloni upravljanje / Ukloni profil.
4. Zatim provjerite postoji li skriveni Certifikat korijena čovjeka u sredini: Idite na Postavke -> Općenito -> O meni -> Postavke povjerenja certifikata (na samom dnu). Ispod Enable Full Trust for Root Certificates, trebalo bi biti uključeno nula prilagođenih certifikata. Ako je jedan uključen, odmah ga isključite i izbrišite profil.

4. Provjerite "Wi-Fi iTunes / Finder Backup Stalkerware" (iMazing / Desktop Stalkerware Sync)¶

Kako web-mjesta komercijalnog programa za uhođenje (mSpy, Cocospy, Eyezy) tvrde da nude "špijunski softver za iPhone bez bjekstva iz zatvora"? Koriste dva trika: - Trik A (iCloud Backup Credential Scraper): Zlostavljač upisuje vašu Apple ID e-poštu, lozinku i jednokratni 6-znamenkasti 2FA kod (preuzet sa vašeg zaključanog zaslona dok ste spavali) u cloud poslužitelj tvrtke za stalkerware. Svake noći u 02:00 kada vaš iPhone učitava svoju noćnu iCloud sigurnosnu kopiju, stalkerware poslužitelj preuzima kopiju vaše sigurnosne kopije i izvlači vaše tekstove, WhatsApp bazu podataka, fotografije i povijest poziva. - Kako odmah ubiti trik A: promijenite svoju Apple ID lozinku, uklonite nepoznate Pouzdane telefonske brojeve na Settings -> [Your Name] -> Sign-In & Security, i promijenite 6-znamenkasti zaporku za zaključavanje zaslona za iPhone (Settings -> Face ID & Passcode -> Change Passcode). - Trik B (Lokalna Wi-Fi sinkronizacija s prijenosnim računalom na istoj kućnoj mreži): Zlostavljač priključi vaš otključani iPhone na svoje Windows PC ili MacBook putem USB kabela na 2 minute dok ste pod tušem, dodirne "Vjeruj ovom računalu" pomoću svoje šifre i označi okvir u iTunes/Finderu (ili komercijalnoj desktop aplikaciji za stalkerware) s oznakom "Sinkroniziraj s ovim iPhoneom preko Wi-Fi". Od tog dana pa nadalje, svaki put kad uđete u kuću i vaš iPhone se poveže s kućnom Wi-Fi mrežom, njihovo prijenosno računalo tiho izvuče potpunu forenzičku sigurnosnu kopiju vašeg cijelog iPhonea putem Wi-Fi mreže bez ikakvog uključivanja kabela. - Kako odmah uništiti trik B: Čak ni promjena lozinke za Apple ID ne opoziva lokalno USB/Wi-Fi računalo Trust uparivanje. Za brisanje svih pouzdanih računala na iOS-u bez poništavanja cijelog telefona, idite na Postavke -> Općenito -> Prijenos ili resetiranje iPhonea -> Reset -> Resetiraj lokaciju i privatnost (ili promijenite šifru i omogućite Zaštitu ukradenog uređaja; priključivanje na računalo i resetiranje povijesti sinkronizacije ili izvođenje potpunog Brisanja svih sadržaja i postavki trajno uništava sve lockdownd potvrde o uparivanju).

5. Check Third-Party Location Apps (Google Maps, Life360, Snapchat Snap Map, Strava)¶

Apple's Safety Check resets Apple's native Find My location sharing, but an abuser may have turned on continuous 24/7 location sharing inside a third-party app that you already use every day: 1. Google Maps on iPhone or Android: Open the Google Maps app -> tap your Profile picture (top right) -> tap Location sharing. Verify that nobody is receiving your live 24/7 Google Maps location stream. 2. Audit Every App with "Always" Location Permission: Go to Settings -> Privacy & Security -> Location Services. Scroll down your entire app list and look for any app marked Always. Switch every app from Always to While Using the App or Never. 3. Check for Hidden Keyboard Extensions (Third-Party Keyloggers): Go to Settings -> General -> Keyboard -> Keyboards. It should only list English (or your native language) and Emoji. If you see any third-party keyboard with Allow Full Access enabled, delete it immediately.

Phase 2: Complete step-by-step Android spyware & stalkerware (APK) audit¶

Because Android allows users to install application packages (.APK files) directly from web browsers outside the Google Play Store, commercial stalkerware (mSpy, FlexiSPY, Hoverwatch, uMobix, TheTruthSpy, KidsGuard Pro, Spyic) is significantly more common as an actual installed background program on Android than on iOS.

When an abuser installs stalkerware on an Android phone, the installer prompts the abuser to turn OFF Google Play Protect, grant Accessibility Service / Device Admin / Notification Access permissions, and then hides its own icon from the home screen app drawer while masquerading inside the Settings menu under a fake system name like System Service, Update Service, Google Framework Service, Wi-Fi Helper, ili Device Health.

Follow This 6-Step Android Detection & Removal Sequence¶

1. Step 1: Check and Re-Enable Google Play Protect Immediately:
   • Every commercial Android stalkerware installation guide instructs the abuser to turn off Google Play Protect as Step 1, because Play Protect detects and auto-disables known commercial stalkerware signatures.
   • Open the Google Play Store app -> tap your Profile icon (top right) -> tap Play Protect -> tap the Settings (Gear icon) in the top right corner.
   • If Scan apps with Play Protect is toggled OFF, that is a massive red flag that someone manually disabled your phone's anti-malware shield to sideload stalkerware. Photograph that screen with a second camera, toggle Scan apps with Play Protect back ON, and run a manual scan.
2. Step 2: Audit Accessibility Services (Where Android Keyloggers Live):
   • Android locks apps inside sandboxes too, so how does an Android stalkerware app read your WhatsApp/Signal chats and record every keystroke you type? By abusing Android's Accessibility API (originally designed to read the screen aloud for visually impaired users).
   • Open Settings -> Accessibility -> look under Downloaded Apps / Installed Apps / Installed Services.
   • What should be here: Unless you personally use a screen reader or password manager autofill via Accessibility, zero unfamiliar apps should have Accessibility turned on. If you see an unfamiliar service named System Update, Sync Service, Security Service, ili Device Health with Accessibility toggled ON, photograph it and toggle it OFF immediately.
3. Step 3: Audit Device Admin Apps (Why You Can't Click "Uninstall" on Stalkerware):
   • Stalkerware registers itself as a Device Administrator so that if you try to uninstall it, the "Uninstall" button is grayed out.
   • Open Settings -> Security & Privacy (or Biometrics and Security) -> More Security Settings -> Device Admin Apps (or simply type Device admin apps u gornju traku za pretraživanje vaše aplikacije Postavke).
   • Pogledajte svaku provjerenu aplikaciju. Samo Find My Device (ili aplikacija radnog profila vašeg poslodavca) trebala bi biti aktivna. Ako vidite da je aplikacija generičkog zvuka omogućena kao Administrator uređaja, najprije je poništite/deaktivirajte, nakon što je deaktivirana ovdje, Uninstall gumb na glavnom popisu aplikacija će se otključati.
4. Korak 4: Revizija Notification Access i Appear on Top (Draw Over Other Apps):
   • Otvorite Postavke -> Aplikacije -> Poseban pristup aplikacijama (na Samsungu: Settings -> Apps -> Three-dot menu -> Special access).
   • Dodirnite Pristup obavijestima (ili Obavijesti uređaja i aplikacija): bilo koja aplikacija koja je ovdje uključena može tiho pročitati cijeli tekst svake dolazne obavijesti SMS-a, WhatsApp-a, Signala i e-pošte, pa čak i automatski odbaciti sigurnosna upozorenja prije nego što vaš zaslon zasvijetli. Isključite sve nepoznato.
   • Vratite se i dodirnite Pojavi se na vrhu (ili Prikaži preko drugih aplikacija) i Medijska projekcija: Stalkerware ih koristi za snimanje tihih snimaka zaslona i preklapanje nevidljivih prozora za zapis tipki.
5. Korak 5: Pregledajte komplet All Apps Popis (razvrstan po veličini ili datumu instalacije):
   • Otvorite Postavke -> Aplikacije -> Vidi sve aplikacije.
   • Dodirnite Izbornik s tri točke (gore desno) i odaberite Prikaži sustav (samo nakon provjere popisa običnih korisničkih aplikacija).
   • Na popisu uobičajenih korisničkih aplikacija (sa Show system isključeno), polako se pomičite odozgo prema dolje. Stalkerware se ne može sakriti od Settings -> Apps čak i kada skriva svoju ikonu s vašeg početnog zaslona. Potražite bilo koju aplikaciju sa:
     • prazna bijela ikona, generička zelena ikona Android robota ili ikona zupčanika pod nazivom System Update, Settings, Backup, SyncService, CoreService, ili com.android.system.. pojavljuju se na popisu aplikacija Korisnik/preuzeto.
     • Dodirnite sumnjivu aplikaciju -> pomaknite se do samog dna njezine stranice Informacije o aplikaciji i pročitajte redak: App installed from... Kažu originalne aplikacije sustava i legitimne aplikacije Installed from Google Play Store ili dolaze predinstalirani na uređaju samo za čitanje /system pregrada. Ako piše Installed from Chrome, Installed from Files / My Files, ili Package installer, netko je to ručno preuzeo i učitao sa strane .APK datoteku na svoj telefon.
6. Korak 6: Provjerite Google Messages for Web i Google Account Activity:
   • Otvorite zadanu aplikaciju Poruke (Google Messages) na svom Android telefonu -> dodirnite Ikonu profila (gore desno) -> dodirnite Uparivanje uređaja.
   • Ako vidite bilo koje upareno računalo (Chrome on Windows, MacOS, itd.), netko je skenirao vaš QR kod na messages.google.com/web i čita i šalje vaše SMS/RCS tekstove uživo iz svog preglednika. Odmah dodirnite Uspari sve uređaje.

Faza 3: Provjera vaših aplikacija za razmjenu poruka, kućnog Wi-Fija i plana mobilnog operatera¶

Čak i ako je hardver vašeg telefona 100 posto čist, napadač može presresti vašu komunikaciju kroz tri vanjska sloja:

1. Pregledajte svaku aplikaciju za slanje poruka Linked Devices Izbornik (traje 60 sekundi)¶

Moderne end-to-end šifrirane aplikacije za razmjenu poruka omogućuju povezivanje do 4 ili 5 pratećih stolnih preglednika ili tableta putem brzog skeniranja QR koda. Odmah provjerite sve ove četiri aplikacije: - WhatsApp: dodirnite Postavke -> Povezani uređaji. Odjavite se sa svake sesije koju ne prepoznajete. Također idite na Postavke -> Razgovori -> Sigurnosna kopija razgovora i provjerite je li netko uključio nekriptirano sigurnosno kopiranje na nepoznati račun i uključite PIN za potvrdu u dva koraka (Settings -> Account -> Two-step verification). - Signal: Dodirnite svoju Ikonu profila (gore lijevo) -> Postavke -> Povezani uređaji. Uklonite sve nepoznate Signal Desktop ili iPad primjer. - Telegram: Dodirnite Postavke -> Uređaji (aktivne sesije). Dodirnite Prekini sve druge sesije ako vidite bilo koji nepoznati grad, računalo ili web preglednik i označite Postavke -> Privatnost i sigurnost -> Provjera u dva koraka. - Instagram / Facebook Messenger / Snapchat: Otvorite Postavke -> Centar za račune -> Lozinka i sigurnost -> Gdje ste prijavljeni i odjavite se sa svih nepoznatih telefona ili preglednika stolnih računala.

2. Saznajte što vaš račun za mobilni operater otkriva na zajedničkom obiteljskom planu¶

Ako je vaš telefonski broj na dijeljenom obiteljskom planu gdje je supružnik, partner, roditelj ili poslodavac primarni vlasnik računa (ili ima prijavu na att.com, verizon.com, t-mobile.com, rogers.com, ili vodafone.co.uk): - Što vlasnik primarnog računa UVIJEK može vidjeti na web stranici mobilnog operatera: - Čak i bez dodirivanja vašeg telefona, primarni vlasnik računa može preuzeti Detaljni mjesečni dnevnik korištenja poziva i SMS-a u PDF-u. Dok se tekstualni sadržaj vaših SMS poruka obično ne prikazuje na standardnim računima, dnevnik operatera navodi svaki pojedini 10-znamenkasti telefonski broj koji ste nazvali ili poslali poruku, točan datum i minutu poziva/teksta i točno trajanje svakog telefonskog poziva. - Therefore, if you call a domestic violence hotline, a divorce attorney, a real estate agent, or a friend using a standard cellular phone call on a shared family plan, that phone number will print right on the carrier web portal within minutes. - How to Communicate Privately If You Are Stuck on a Shared Carrier Plan: - Nikada nemojte upućivati ​​redovite mobilne glasovne pozive ili slati redovne SMS/MMS poruke na osjetljive brojeve s telefona sa zajedničkim planom. - Instead, calls and messages made inside Signal, WhatsApp, FaceTime Audio, or a web browser over cellular data (especially with a trusted VPN like ProtonVPN or Mullvad active) show up on the carrier bill only as generic encrypted internet data megabytes (15.4 MB Web Data), nikad ne otkrivajući koga ste zvali ili slali poruke.

Faza 4: Otkrivanje Zero-Click plaćenog špijunskog softvera (Pegasus / Predator) for High-Risk Targets¶

If you are an investigative journalist, human rights defender, political dissident, senior government official, defense contractor, or corporate executive and suspect you have been targeted by advanced nation-state mercenary spyware (such as NSO Group's Pegasus or Intellexa's Predator):

1. Why Standard Manual Checks Don't Find Pegasus: Unlike $29/month consumer stalkerware (mSpy), zero-click mercenary spyware does not appear in Settings -> Apps ili Accessibility. It exploits zero-day vulnerabilities in iMessage, FaceTime, WhatsApp, or WebKit to execute code directly in system memory (RAM).
2. Immediate Defense 1: Reboot Your Phone Every Single Morning:
   • Research by Amnesty International's Security Lab and Citizen Lab (University of Toronto) revealed that to evade forensic detection on modern iOS devices (where the root file system is cryptographically sealed read-only via Apple's Signed System Volume), modern Pegasus payloads often operate in-memory only (non-persistent).
   • Shutting down and restarting your iPhone or Android completely every 24 hours wipes volatile RAM and forces the attacker to risk firing a brand-new zero-day exploit to re-infect the phone.
3. Immediate Defense 2: Enable Apple Lockdown Mode or Android Advanced Protection:
   • On iPhone (iOS 16+): Go to Settings -> Privacy & Security -> Lockdown Mode -> Turn On Lockdown Mode. Lockdown Mode hardens the device by blocking most message attachment types, disabling complex WebKit Just-In-Time (JIT) JavaScript compilers, blocking incoming FaceTime calls from numbers you have not previously called, and blocking wired USB data connections while locked. (To date, Citizen Lab and Amnesty International have documented that Lockdown Mode successfully blocks known zero-click iMessage exploit chains).
4. How to Perform a True Forensic Check (MVT: Mobile Verification Toolkit):
   • Never pay scam websites or random cybersecurity apps claiming to "scan for Pegasus".
   • Instead, use MVT (Mobile Verification Toolkit), the free, open-source forensic tool created and maintained by Amnesty International (docs.mvt.re). MVT analyzes an encrypted iTunes/Finder backup and sysdiagnose log (or Android adb bugreport) on a Linux or macOS computer against regularly updated Indicators of Compromise (IoCs) (Shutdown.log anomalies, DataUsage.sqlite process ghosts, and malicious domain artifacts).
   • If you are a journalist, activist, or civil society member, you can also request free forensic analysis directly from Access Now's 24/7 Digital Security Helpline (accessnow.org/help) or Amnesty International's Security Lab.

Često postavljana pitanja¶

Izvori provjereni¶

• National Network to End Domestic Violence (NNEDV, United States): Safety Net Project: Technology Safety & Stalkerware Triage Guidelines for Survivors (techsafety.org).
• Cybersecurity and Infrastructure Security Agency (CISA) & National Security Agency (NSA, United States): Mobile Device Best Practices: Mitigating Spyware, Spear-Phishing, and Zero-Click Exploits (cisa.gov).
• Apple Platform Security & Support (United States): Safety Check on iPhone (iOS 16/17/18) User Guide and Lockdown Mode Technical Specification (support.apple.com/guide/personal-safety).
• Google Safety Center & Android Security (United States): Google Play Protect Stalkerware Detection, Unknown Tracker Alerts, and Accessibility Permission Auditing (support.google.com/android).
• Coalition Against Stalkerware (International): Indicators of Compromise, Forensic Preservation Before Removal, and Survivor Safety Planning (stopstalkerware.org).
• Amnesty International Security Lab & Citizen Lab at the University of Toronto (International): Mobile Verification Toolkit (MVT) Documentation and Forensic Methodology for Detecting Pegasus / Mercenary Spyware (docs.mvt.re, citizenlab.ca).
• National Cyber Security Centre (NCSC) & Refuge Tech Safety (United Kingdom): Guidance on Spotting and Removing Spyware and Securing Shared Accounts (ncsc.gov.uk, refugetechsafety.org).

Povezani vodiči¶

• GPS tracker and AirTag stalking
• Smart home hack, camera hijacking, and stalkerware
• Domestic violence
• Plan oporavka od nasilja u obitelji i sigurnosni plan
• Stalking and physical surveillance defense
• Hakirani račun e-pošte: skrivena pravila prosljeđivanja i oporavak