Mendeteksi Stalkerware, Spyware, dan Akses Tersembunyi di Ponsel¶

Mencurigai seseorang diam-diam membaca pesan teks Anda, mendengarkan panggilan telepon Anda, melacak lokasi GPS real-time Anda, atau melihat setiap penekanan tombol yang Anda ketik di iPhone atau ponsel pintar Android adalah krisis keselamatan pribadi dan keamanan digital yang mendesak. Namun, sebelum Anda menghapus aplikasi mencurigakan atau mengubah satu kata sandi di ponsel Anda, Anda harus memahami dua fakta penting tentang pengawasan ponsel cerdas modern. Pertama, risiko peningkatan fisik adalah nyata: dalam kekerasan dalam rumah tangga, kontrol paksaan, atau situasi penguntitan, menghapus aplikasi penguntit (mSpy, FlexiSPY, Cocospy, Hoverwatch, uMobix, Eyezy, atau KidsGuard) atau memutus pembagian lokasi akan mengirimkan peringatan pemutusan koneksi secara instan ke dasbor pelaku, yang dapat langsung memicu pembalasan fisik. Kedua, 90 persen spionase ponsel cerdas modern BUKAN merupakan "virus peretas Hollywood" tak kasat mata yang terpasang di internet, melainkan dilakukan oleh seseorang yang mengetahui atau menebak kode sandi ponsel Anda yang terdiri dari 4 hingga 6 digit, masuk ke Apple iCloud / Akun Google Anda di perangkat lain, memindai kode QR Perangkat Tertaut WhatsApp / iMessage / Sinyal Anda, mengaktifkan Aksesibilitas Android / Admin Perangkat yang melakukan sideload penguntit, atau menempatkan ponsel Anda pada Paket Keluarga Bersama / Profil MDM.

Jika saat ini Anda berada dalam bahaya fisik dari pasangan, penguntit, atau penyusup, hubungi nomor darurat setempat (911 di Amerika Serikat dan Kanada, 112 di seluruh Uni Eropa, 999 di Inggris) dari telepon aman atau lihat direktori internasional kami nomor darurat. Jika Anda mencurigai ponsel Anda saat ini dipantau oleh mitra atau penguntit yang melakukan kekerasan, baca Langkah 1 di bawah sebelum mengubah pengaturan apa pun pada perangkat tersebut.

Lakukan ini sekarang¶

1. Nilai keamanan fisik Anda SEBELUM menghapus perangkat penguntit atau mencabut akses akun: Jika mitra, mantan mitra, atau penguntit yang melakukan kekerasan memantau ponsel Anda, menghapus perangkat, atau mengeluarkan mereka dari akun iCloud/Google Anda, segera beri tahu mereka bahwa Anda telah menemukan pengawasan. Jika menghapus akses dapat menempatkan Anda dalam bahaya fisik, biarkan ponsel yang dipantau tetap seperti apa adanya sehingga ponsel tetap menampilkan aktivitas normal dan membosankan, dan belilah "Telepon Aman" (Telepon Pembakar) prabayar yang terpisah dan murah yang dibayar dengan uang tunai di supermarket atau apotek untuk menelepon tempat penampungan kekerasan dalam rumah tangga, pengacara, keluarga, atau polisi.
2. Jangan pernah mengatur "Telepon Aman" baru di Wi-Fi rumah Anda atau menautkannya ke ID Apple, Akun Google, atau nomor telepon lama Anda: Jaga agar Telepon Aman Anda benar-benar terputus dari kehidupan digital lama Anda, buat ID Apple atau Akun Google baru dengan nama fiktif, jangan pernah menghubungkannya ke router Wi-Fi rumah Anda (yang mencatat alamat MAC dan nama host perangkat yang terhubung), matikan Bluetooth dan Layanan Lokasi saat tidak diperlukan, dan jangan pernah menelepon atau mengirim SMS ke nomor telepon lama Anda dari Telepon Aman.
3. Jika aman untuk mengunci iPhone Anda saat ini, jalankan aplikasi bawaan Apple Safety Check (Settings -> Privacy & Security -> Safety Check): Introduced for iOS 16, 17, and 18+, Safety Check provides a one-button Emergency Reset that immediately stops all Find My location sharing with everyone, resets privacy permissions (microphone, camera, photos, location) across all apps, restricts iMessage and FaceTime strictly to the single iPhone in your hand, and helps you remove unfamiliar devices from your Apple Account and change your passcode.
4. Check for "Zero-Install" Cloud & Messaging Mirroring (iCloud Devices, Google Find My Device, and WhatsApp Linked Devices): Before hunting for hidden spy apps, check the 3 places where 85 percent of real-world snooping happens:
   • WhatsApp / Signal / Telegram: Open Settings -> Linked Devices. If you see a Google Chrome (Windows/Mac) atau Safari session you do not recognize, tap it and click Log Out immediately, someone scanned your QR code while you were asleep or in the shower and has been reading every message live on their laptop.
   • Apple iCloud / Google Account Device List: Check Settings -> [Your Name] on iPhone (scroll to the bottom) or myaccount.google.com/device-activity on Android to see if an old iPad, spare iPhone, or desktop computer is logged into your cloud account syncing your photos, texts, and live GPS location.
5. On Android, run a Google Play Protect scan and audit Accessibility Services, Device Admin Apps, dan Notification Access: Unlike iPhones (which block sideloading outside specific regions), an attacker with 3 minutes of physical access to your unlocked Android phone can disable Google Play Protect, download an .APK stalkerware installer (disguised in your app list as System Update, Settings, Wi-Fi Service, atau Device Health), and grant it full screen-reading Accessibility and Notification Listener permissions.
6. Before wiping a phone, take forensic screenshots or photos of the spyware with a second camera for law enforcement and family court: Installing stalkerware or intercepting private electronic communications without consent is a serious felony in the United States (Federal Wiretap Act, 18 U.S.C. § 2511 and CFAA, 18 U.S.C. § 1030), the United Kingdom (Computer Misuse Act 1990), Canada (Criminal Code s. 184 & s. 342.1), the European Union, and Australia. Before factory-resetting your phone, use a different phone's camera to photograph the unfamiliar Linked Devices, suspicious .APK permissions, and Account Login logs as admissible evidence for a restraining order or criminal prosecution.

Decision tree: diagnosing how your phone is being monitored¶

Use this technical triage flowchart to distinguish between Cloud/Account Mirroring, Commercial Stalkerware (.APK / MDM), Cellular Carrier Family Tracking, and Advanced Exploit Spyware:

flowchart TD
    A["Suspected Phone Surveillance: Texts Read, Calls Known, or Live Location Tracked"] --> B{"Is it physically safe to cut off the stalker's access right now?"}
    B -->|"No: Abuser is in the home or may retaliate violently"| C["Do NOT alter the monitored phone. Acquire a Cash-Purchased Prepaid Safe Phone on a Separate Cellular Network"]
    B -->|"Yes: Safe to audit and purge surveillance"| D{"What operating system does the phone run?"}
    D -->|"Apple iPhone (iOS)"| E["1. Run iOS Safety Check (Settings -> Privacy & Security -> Safety Check)"]
    E --> F["2. Check Settings -> General -> VPN & Device Management for MDM Profiles or Configuration Certificates"]
    F --> G["3. Audit WhatsApp/Signal Linked Devices, AirTag/Find My Alerts & Shared Mobile Carrier Account"]
    G --> H{"Do you suspect Zero-Click Nation-State Mercenary Spyware (Pegasus / Predator)?"}
    H -->|"Yes (Journalist, Dissident, Executive, High-Risk Target)"| I["Enable iOS Lockdown Mode, Reboot Daily, Capture Sysdiagnose & Scan with MVT (Mobile Verification Toolkit)"]
    H -->|"No (Domestic / Stalkerware Scenario)"| J["Change Device Passcode (6+ Digit Alphanumeric), Change Apple ID Password, Enable 2FA & Factory Reset if Jailbroken"]
    D -->|"Android (Samsung, Pixel, Motorola, etc.)"| K["1. Turn On Google Play Protect (Play Store -> Profile -> Play Protect -> Scan)"]
    K --> L["2. Audit Settings -> Accessibility, Device Admin Apps, Notification Access & Appear on Top"]
    L --> M["3. Audit WhatsApp/Google Messages Web Pairing (`messages.google.com/web`) & Google Location Sharing"]
    M --> N["Photograph Evidence with Second Camera, Back Up Only Plain Photos/Contacts, and Execute Full Factory Reset"]

Understanding the 4 tiers of mobile surveillance (How did they get in?)¶

When someone knows exact details from your private conversations or knows everywhere you drove today, it is easy to panic and think they have supernatural hacking abilities. In reality, smartphone surveillance falls into four concrete technical categories, and over 95 percent of domestic, relationship, and workplace cases are Tier 1, Tier 2, or Tier 3:

Phase 1: Complete step-by-step iPhone (iOS / iPadOS) spyware & stalkerware audit¶

Apple's iOS operating system enforces mandatory hardware-verified code signing and strict app sandboxing. An App Store app cannot secretly read your text messages, record your phone calls, or log your keystrokes outside its own app. Therefore, if someone is spying on your iPhone (assuming it is not visibly Jailbroken and you are not a target of a million-dollar government agency), they are using one of the seven specific iOS mechanisms below. Check every single one in order:

1. Run Apple Safety Check (iOS 16, 17, 18+)¶

1. Buka Pengaturan -> Privasi & Keamanan -> gulir ke bawah dan ketuk Pemeriksaan Keamanan.
2. Tap Manage Sharing & Access (if you want to inspect exactly who has access before cutting it off, so you can photograph it as evidence) OR tap Emergency Reset (to immediately cut off all sharing at once).
3. Di dalam Kelola Berbagi & Akses, iOS menampilkan daftar forensik terpadu yang berisi:
   • Setiap orang yang Anda ajak berbagi Temukan Lokasi Saya, Album Foto Bersama, Kalender Bersama, Catatan Bersama, Pengingat Bersama, Rumah HomeKit, dan Data Kesehatan.
   • Setiap Kata Sandi Bersama (AirDrop / Passwords Family Sharing) grup.
   • Setiap perangkat masuk ke ID Apple Anda.

2. Periksa Settings -> [Your Name] untuk Perangkat Pencerminan Rahasia (Trik "iPad Tersembunyi")¶

1. Buka Pengaturan dan ketuk [Nama Anda / Akun Apple] di bagian paling atas.
2. Gulir ke bawah untuk melihat Daftar Perangkat Anda.
3. Apa yang harus dicari: Lihat setiap iPhone, iPad, Mac, Apple Watch, atau PC Windows yang terdaftar. Taktik pengawasan domestik yang sangat umum adalah ketika pasangan Anda mengambil iPad lama atau iPhone cadangan, menandatanganinya ke ID Apple Anda menggunakan kode sandi ponsel saat Anda tidur, mematikan notifikasi di iPad tersebut, dan menyembunyikannya di laci atau tas kerja. IPad tersembunyi itu menerima setiap iMessage, SMS (melalui Penerusan Pesan Teks), foto, dan siaran langsung Find My melakukan ping secara real-time.
4. Ketuk perangkat apa pun yang saat ini tidak Anda miliki secara fisik dan ketuk Hapus dari Akun.
5. Selanjutnya, buka Pengaturan -> Aplikasi -> Pesan -> Penerusan Pesan Teks (atau Settings -> Messages -> Text Message Forwarding) dan matikan MATI Mac atau iPad apa pun yang terdaftar di sana sehingga teks SMS gelembung hijau standar tidak dicerminkan ke layar lain.

3. Periksa Penjahat MDM (Manajemen Perangkat Seluler) Profil dan Sertifikat Root¶

Meskipun aplikasi biasa tidak dapat memata-matai iPhone, Profil Konfigurasi perusahaan (.mobileconfig) atau profil Manajemen Perangkat Seluler (MDM), atau Sertifikat TLS Root khusus, memungkinkan administrator merutekan semua lalu lintas internet Anda melalui server proxy, melacak lokasi perangkat, dan memeriksa lalu lintas web terenkripsi.

1. Buka Pengaturan -> Umum -> gulir ke bawah dan ketuk VPN & Manajemen Perangkat.
2. Apa yang harus ada di sini: Kecuali iPhone Anda dimiliki oleh perusahaan atau sekolah Anda, di bawah Mobile Device Management atau Configuration Profiles there should be ZERO profiles installed (only your normal consumer VPN app if you personally installed one like ProtonVPN or Mullvad).
3. If you see an unfamiliar MDM Profile, "Parental Control / Family Profile", or "Analytics / Beta Profile" you did not install, photograph it with another camera and tap Remove Management / Remove Profile.
4. Next, check for a hidden Man-in-the-Middle Root Certificate: Go to Settings -> General -> About -> Certificate Trust Settings (at the very bottom). Under Enable Full Trust for Root Certificates, there should be zero custom certificates toggled on. If one is toggled on, turn it off immediately and delete the profile.

4. Check for "Wi-Fi iTunes / Finder Backup Stalkerware" (iMazing / Desktop Stalkerware Sync)¶

How do commercial stalkerware websites (mSpy, Cocospy, Eyezy) claim to offer "No-Jailbreak iPhone Spyware"? They use two tricks: - Trick A (iCloud Backup Credential Scraper): The abuser types your Apple ID email, password, and a one-time 6-digit 2FA code (grabbed from your lock screen while you were asleep) into the stalkerware company's cloud server. Every night at 02:00 when your iPhone uploads its nightly iCloud Backup, the stalkerware server downloads a copy of your backup and extracts your texts, WhatsApp database, photos, and call history. - How to Kill Trick A Instantly: Change your Apple ID Password, remove unfamiliar Trusted Phone Numbers at Settings -> [Your Name] -> Sign-In & Security, and change your iPhone 6-digit Screen Lock Passcode (Settings -> Face ID & Passcode -> Change Passcode). - Trick B (Local Wi-Fi Sync to a Laptop on the Same Home Network): The abuser plugs your unlocked iPhone into their Windows PC or MacBook via a USB cable for 2 minutes while you are in the shower, taps "Trust This Computer" using your passcode, and checks the box in iTunes/Finder (or a commercial stalkerware desktop app) labeled "Sync with this iPhone over Wi-Fi". From that day forward, every single time you walk into the house and your iPhone connects to the home Wi-Fi, their laptop silently pulls a full forensic backup of your entire iPhone over Wi-Fi without ever plugging in a cable. - How to Kill Trick B Instantly: Even changing your Apple ID password does not revoke a local USB/Wi-Fi Computer Trust pairing. To wipe all trusted computers on iOS without resetting your whole phone, go to Settings -> General -> Transfer or Reset iPhone -> Reset -> Reset Location & Privacy (or change your passcode and enable Stolen Device Protection; plugging into a computer and resetting Sync History or performing a full Erase All Content and Settings permanently destroys all lockdownd pairing certificates).

5. Check Third-Party Location Apps (Google Maps, Life360, Snapchat Snap Map, Strava)¶

Apple's Safety Check resets Apple's native Find My location sharing, but an abuser may have turned on continuous 24/7 location sharing inside a third-party app that you already use every day: 1. Google Maps on iPhone or Android: Open the Google Maps app -> tap your Profile picture (top right) -> tap Location sharing. Verify that nobody is receiving your live 24/7 Google Maps location stream. 2. Audit Every App with "Always" Location Permission: Go to Settings -> Privacy & Security -> Location Services. Scroll down your entire app list and look for any app marked Always. Switch every app from Always to While Using the App or Never. 3. Check for Hidden Keyboard Extensions (Third-Party Keyloggers): Go to Settings -> General -> Keyboard -> Keyboards. It should only list English (or your native language) and Emoji. If you see any third-party keyboard with Allow Full Access enabled, delete it immediately.

Phase 2: Complete step-by-step Android spyware & stalkerware (APK) audit¶

Because Android allows users to install application packages (.APK files) directly from web browsers outside the Google Play Store, commercial stalkerware (mSpy, FlexiSPY, Hoverwatch, uMobix, TheTruthSpy, KidsGuard Pro, Spyic) is significantly more common as an actual installed background program on Android than on iOS.

When an abuser installs stalkerware on an Android phone, the installer prompts the abuser to turn OFF Google Play Protect, grant Accessibility Service / Device Admin / Notification Access permissions, and then hides its own icon from the home screen app drawer while masquerading inside the Settings menu under a fake system name like System Service, Update Service, Google Framework Service, Wi-Fi Helper, atau Device Health.

Ikuti Urutan Deteksi & Penghapusan Android 6 Langkah Ini¶

1. Step 1: Check and Re-Enable Google Play Protect Langsung:
   • Setiap panduan instalasi penguntit Android komersial memerintahkan pelaku untuk mematikannya Google Play Protect sebagai Langkah 1, karena Play Protect mendeteksi dan menonaktifkan secara otomatis tanda tangan penguntit komersial yang dikenal.
   • Buka aplikasi Google Play Store -> ketuk Ikon profil (kanan atas) -> ketuk Play Protect -> ketuk Pengaturan (ikon Roda Gigi) di pojok kanan atas.
   • Jika Scan apps with Play Protect dalam keadaan MATI, itu adalah tanda bahaya besar bahwa seseorang secara manual menonaktifkan pelindung anti-malware ponsel Anda untuk melakukan sideload perangkat penguntit. Potret layar tersebut dengan kamera kedua, alihkan Pindai aplikasi dengan Play Protect kembali ON, dan jalankan pemindaian manual.
2. Langkah 2: Audit Accessibility Services (Tempat Tinggal Keylogger Android):
   • Android juga mengunci aplikasi di dalam kotak pasir, jadi bagaimana aplikasi penguntit Android membaca obrolan WhatsApp/Signal Anda dan merekam setiap penekanan tombol yang Anda ketik? Dengan menyalahgunakan Accessibility API Android (awalnya dirancang untuk membacakan layar dengan lantang bagi pengguna tunanetra).
   • Buka Pengaturan -> Aksesibilitas -> lihat di bawah Aplikasi yang Diunduh / Aplikasi Terinstal / Layanan Terinstal.
   • Apa yang seharusnya ada di sini: Kecuali Anda secara pribadi menggunakan pembaca layar atau pengelola kata sandi isi otomatis melalui Aksesibilitas, tidak ada aplikasi asing yang seharusnya mengaktifkan Aksesibilitas. Jika Anda melihat layanan asing bernama System Update, Sync Service, Security Service, atau Device Health dengan Aksesibilitas diaktifkan ON, potret dan segera matikan OFF.
3. Langkah 3: Audit Device Admin Apps (Mengapa Anda Tidak Dapat Mengklik "Uninstall" di Stalkerware):
   • Stalkerware mendaftarkan dirinya sebagai Administrator Perangkat sehingga jika Anda mencoba menghapus instalannya, tombol "Copot" berwarna abu-abu.
   • Open Settings -> Security & Privacy (or Biometrics and Security) -> More Security Settings -> Device Admin Apps (or simply type Device admin apps into the top search bar of your Settings app).
   • Look at every app checked. Only Find My Device (or your employer's work profile app) should be active. If you see a generic-sounding app enabled as a Device Admin, uncheck / deactivate it first, once deactivated here, its Uninstall button in the main App list will unlock.
4. Step 4: Audit Notification Access dan Appear on Top (Draw Over Other Apps):
   • Open Settings -> Apps -> Special App Access (on Samsung: Settings -> Apps -> Three-dot menu -> Special access).
   • Tap Notification access (or Device & app notifications): Any app toggled ON here can silently read the full text of every incoming SMS, WhatsApp, Signal, and email notification and even auto-dismiss security alerts before your screen lights up. Turn off anything unfamiliar.
   • Go back and tap Appear on top (or Display over other apps) and Media projection: Stalkerware uses these to capture silent screenshots and overlay invisible keylogging windows.
5. Langkah 5: Periksa Kelengkapannya All Apps List (Sorted by Size or Install Date):
   • Open Settings -> Apps -> See all apps.
   • Tap the Three-dot menu (top right) and select Show system (only after checking the regular user apps list first.).
   • In the regular user app list (with Show system turned OFF), scroll slowly from top to bottom. Stalkerware cannot hide from Settings -> Apps even when it hides its icon from your home screen. Look for any app with:
     • A blank white icon, a generic green Android robot icon, or a gear icon named System Update, Settings, Backup, SyncService, CoreService, atau com.android.system.. appearing in the User/Downloaded apps list.
     • Ketuk aplikasi yang mencurigakan -> gulir ke bagian paling bawah halaman Info Aplikasi dan baca baris: App installed from... Genuine system apps and legitimate apps say Installed from Google Play Store or come pre-installed on the read-only /system partition. If it says Installed from Chrome, Installed from Files / My Files, atau Package installer, someone manually downloaded and sideloaded that .APK file onto your phone.
6. Step 6: Check Google Messages for Web dan Google Account Activity:
   • Buka aplikasi Pesan (Pesan Google) default di ponsel Android Anda -> ketuk Ikon profil (kanan atas) -> ketuk Pemasangan perangkat.
   • If you see any paired computer (Chrome on Windows, MacOS, etc.), someone scanned your QR code at messages.google.com/web and is reading and sending your SMS/RCS texts live from their browser. Tap Unpair all devices immediately.

Phase 3: Checking your Messaging Apps, Home Wi-Fi, and Cellular Carrier Plan¶

Even if your phone hardware is 100 percent clean, an attacker can intercept your communications through three external layers:

1. Audit Every Messaging App's Linked Devices Menu (Takes 60 Seconds)¶

Modern end-to-end encrypted messaging apps allow linking up to 4 or 5 companion desktop browsers or tablets via a quick QR code scan. Check all four of these apps right now: - WhatsApp: Tap Settings -> Linked Devices. Log out of any session you do not recognize. Also go to Settings -> Chats -> Chat Backup and verify whether someone turned on an unencrypted backup to an unfamiliar account, and turn on Two-Step Verification PIN (Settings -> Account -> Two-step verification). - Signal: Tap your Profile Icon (top left) -> Settings -> Linked Devices. Remove any unfamiliar Signal Desktop atau iPad instance. - Telegram: Ketuk Pengaturan -> Perangkat (Sesi Aktif). Ketuk Hentikan Semua Sesi Lainnya jika Anda melihat kota, PC, atau browser web yang tidak dikenal, dan centang Pengaturan -> Privasi dan Keamanan -> Verifikasi Dua Langkah. - Instagram / Facebook Messenger / Snapchat: Open Settings -> Accounts Center -> Password and security -> Where you're logged in, and log out of all unfamiliar phones or desktop browsers.

2. Understand What Your Cellular Carrier Bill Reveals on a Shared Family Plan¶

If your phone number is on a Shared Family Plan where a spouse, partner, parent, or employer is the Primary Account Holder (or has the login to att.com, verizon.com, t-mobile.com, rogers.com, atau vodafone.co.uk): - What the Primary Account Holder Can ALWAYS See on the Carrier Website: - Even without touching your phone, the Primary Account Holder can download the Detailed Monthly Call & SMS Usage Log PDF. While the text content of your SMS messages is usually not shown on standard bills, the carrier log lists every single 10-digit telephone number you called or texted, the exact date and minute of the call/text, and the exact duration of every phone call. - Therefore, if you call a domestic violence hotline, a divorce attorney, a real estate agent, or a friend using a standard cellular phone call on a shared family plan, that phone number will print right on the carrier web portal within minutes. - How to Communicate Privately If You Are Stuck on a Shared Carrier Plan: - Never place regular cellular voice calls or send regular SMS/MMS texts to sensitive numbers from a shared-plan phone. - Instead, calls and messages made inside Signal, WhatsApp, FaceTime Audio, or a web browser over cellular data (especially with a trusted VPN like ProtonVPN or Mullvad active) show up on the carrier bill only as generic encrypted internet data megabytes (15.4 MB Web Data), never revealing who you called or messaged.

Phase 4: Detecting Zero-Click Mercenary Spyware (Pegasus / Predator) for High-Risk Targets¶

If you are an investigative journalist, human rights defender, political dissident, senior government official, defense contractor, or corporate executive and suspect you have been targeted by advanced nation-state mercenary spyware (such as NSO Group's Pegasus or Intellexa's Predator):

1. Why Standard Manual Checks Don't Find Pegasus: Unlike $29/month consumer stalkerware (mSpy), zero-click mercenary spyware does not appear in Settings -> Apps atau Accessibility. It exploits zero-day vulnerabilities in iMessage, FaceTime, WhatsApp, or WebKit to execute code directly in system memory (RAM).
2. Immediate Defense 1: Reboot Your Phone Every Single Morning:
   • Research by Amnesty International's Security Lab and Citizen Lab (University of Toronto) revealed that to evade forensic detection on modern iOS devices (where the root file system is cryptographically sealed read-only via Apple's Signed System Volume), modern Pegasus payloads often operate in-memory only (non-persistent).
   • Shutting down and restarting your iPhone or Android completely every 24 hours wipes volatile RAM and forces the attacker to risk firing a brand-new zero-day exploit to re-infect the phone.
3. Immediate Defense 2: Enable Apple Lockdown Mode or Android Advanced Protection:
   • On iPhone (iOS 16+): Buka Pengaturan -> Privasi & Keamanan -> Mode Penguncian -> Aktifkan Mode Penguncian. Mode Penguncian memperkeras perangkat dengan memblokir sebagian besar jenis lampiran pesan, menonaktifkan Just-In-Time WebKit yang kompleks (JIT) Kompiler JavaScript, memblokir panggilan FaceTime masuk dari nomor yang belum pernah Anda hubungi sebelumnya, dan memblokir koneksi data USB berkabel saat terkunci. (Sampai saat ini, Citizen Lab dan Amnesty International telah mendokumentasikan bahwa Mode Lockdown berhasil memblokir rantai eksploitasi iMessage zero-click yang diketahui).
4. Cara Melakukan Pemeriksaan Forensik yang Sebenarnya (MVT: Perangkat Verifikasi Seluler):
   • Jangan pernah membayar situs web penipuan atau aplikasi keamanan siber acak yang mengklaim "memindai Pegasus".
   • Sebagai gantinya, gunakan MVT (Mobile Verification Toolkit), alat forensik sumber terbuka dan gratis yang dibuat dan dikelola oleh Amnesty International (docs.mvt.re). MVT menganalisis cadangan iTunes/Finder terenkripsi dan sysdiagnose log (atau Android adb bugreport) di komputer Linux atau macOS terhadap Indikator Kompromi yang diperbarui secara berkala (IoCs) (Shutdown.log anomali, DataUsage.sqlite proses hantu, dan artefak domain berbahaya).
   • Jika Anda seorang jurnalis, aktivis, atau anggota masyarakat sipil, Anda juga dapat meminta analisis forensik gratis langsung dari Saluran Bantuan Keamanan Digital 24/7 Access Now (accessnow.org/help) atau Lab Keamanan Amnesty International.

Pertanyaan yang sering diajukan¶

Sumber diperiksa¶

• National Network to End Domestic Violence (NNEDV, United States): Safety Net Project: Technology Safety & Stalkerware Triage Guidelines for Survivors (techsafety.org).
• Cybersecurity and Infrastructure Security Agency (CISA) & National Security Agency (NSA, United States): Mobile Device Best Practices: Mitigating Spyware, Spear-Phishing, and Zero-Click Exploits (cisa.gov).
• Apple Platform Security & Support (United States): Safety Check on iPhone (iOS 16/17/18) User Guide and Lockdown Mode Technical Specification (support.apple.com/guide/personal-safety).
• Google Safety Center & Android Security (United States): Google Play Protect Stalkerware Detection, Unknown Tracker Alerts, and Accessibility Permission Auditing (support.google.com/android).
• Coalition Against Stalkerware (International): Indicators of Compromise, Forensic Preservation Before Removal, and Survivor Safety Planning (stopstalkerware.org).
• Amnesty International Security Lab & Citizen Lab at the University of Toronto (International): Mobile Verification Toolkit (MVT) Documentation and Forensic Methodology for Detecting Pegasus / Mercenary Spyware (docs.mvt.re, citizenlab.ca).
• National Cyber Security Centre (NCSC) & Refuge Tech Safety (United Kingdom): Guidance on Spotting and Removing Spyware and Securing Shared Accounts (ncsc.gov.uk, refugetechsafety.org).

Panduan terkait¶

• GPS tracker and AirTag stalking
• Smart home hack, camera hijacking, and stalkerware
• Domestic violence
• Domestic violence recovery and safety plan
• Menguntit dan pertahanan pengawasan fisik
• Akun email yang diretas: aturan penerusan dan pemulihan tersembunyi