Telefonlarda stalker dasturlari, josuslik dasturlari va yashirin kirishni aniqlash¶

Suspecting that someone is secretly reading your text messages, listening to your phone calls, tracking your real-time GPS location, or watching every keystroke you type on your iPhone or Android smartphone is an urgent personal safety and digital security crisis. However, before you delete any suspicious app or change a single password on your phone, you must understand two critical facts about modern smartphone surveillance. First, physical escalation risk is real: in domestic abuse, coercive control, or stalking situations, deleting a stalkerware app (mSpy, FlexiSPY, Cocospy, Hoverwatch, uMobix, Eyezy, yoki KidsGuard) or cutting off location sharing sends an instant disconnection alert to the abuser's dashboard, which can trigger immediate physical retaliation. Second, 90 percent of modern smartphone spying is NOT an invisible "Hollywood hacker virus" installed over the internet, instead, it is done by someone who knew or guessed your 4-to-6-digit phone passcode, logged into your Apple iCloud / Google Account on another device, scanned your WhatsApp / iMessage / Signal Linked Devices QR code, enabled Android Accessibility / Device Admin sideloaded stalkerware, or placed your phone on a Shared Family Plan / MDM Profile.

If you are in immediate physical danger from a partner, stalker, or intruder right now, call your local emergency number (911 AQSh va Kanadada, 112 Evropa Ittifoqi bo'ylab, 999 in the United Kingdom) from a safe telephone or consult our directory of international favqulodda raqamlar. If you suspect your current phone is being monitored by an abusive partner or stalker, read Step 1 below before changing any settings on that device.

Buni hozir qiling¶

1. Assess your physical safety BEFORE removing stalkerware or revoking account access: If an abusive partner, ex-partner, or stalker is monitoring your phone, wiping the device or kicking them out of your iCloud/Google account immediately alerts them that you have discovered the surveillance. If removing access could put you in physical danger, leave the monitored phone exactly as it is so it continues showing normal, boring activity, and buy a separate, cheap prepaid "Safe Phone" (Burner Phone) paid for with physical cash at a supermarket or pharmacy to call domestic violence shelters, attorneys, family, or police.
2. Never set up a new "Safe Phone" on your home Wi-Fi or link it to your old Apple ID, Google Account, or phone number: Keep your Safe Phone completely disconnected from your old digital life, create a brand-new Apple ID or Google Account with a fictional name, never connect it to your home Wi-Fi router (which logs connected device MAC addresses and hostnames), keep Bluetooth and Location Services turned off when not needed, and never call or text your old phone number from the Safe Phone.
3. If it is safe to lock down your current iPhone right now, run Apple's built-in Safety Check (Settings -> Privacy & Security -> Safety Check): Introduced for iOS 16, 17, and 18+, Safety Check provides a one-button Emergency Reset that immediately stops all Find My location sharing with everyone, resets privacy permissions (microphone, camera, photos, location) across all apps, restricts iMessage and FaceTime strictly to the single iPhone in your hand, and helps you remove unfamiliar devices from your Apple Account and change your passcode.
4. Check for "Zero-Install" Cloud & Messaging Mirroring (iCloud Devices, Google Find My Device, and WhatsApp Linked Devices): Before hunting for hidden spy apps, check the 3 places where 85 percent of real-world snooping happens:
   • WhatsApp / Signal / Telegram: Open Settings -> Linked Devices. If you see a Google Chrome (Windows/Mac) yoki Safari session you do not recognize, tap it and click Log Out immediately, someone scanned your QR code while you were asleep or in the shower and has been reading every message live on their laptop.
   • Apple iCloud / Google Account Device List: Check Settings -> [Your Name] on iPhone (scroll to the bottom) or myaccount.google.com/device-activity on Android to see if an old iPad, spare iPhone, or desktop computer is logged into your cloud account syncing your photos, texts, and live GPS location.
5. On Android, run a Google Play Protect scan and audit Accessibility Services, Device Admin Apps, va Notification Access: Unlike iPhones (which block sideloading outside specific regions), an attacker with 3 minutes of physical access to your unlocked Android phone can disable Google Play Protect, download an .APK stalkerware installer (disguised in your app list as System Update, Settings, Wi-Fi Service, yoki Device Health), and grant it full screen-reading Accessibility and Notification Listener permissions.
6. Before wiping a phone, take forensic screenshots or photos of the spyware with a second camera for law enforcement and family court: Installing stalkerware or intercepting private electronic communications without consent is a serious felony in the United States (Federal Wiretap Act, 18 U.S.C. § 2511 and CFAA, 18 U.S.C. § 1030), the United Kingdom (Computer Misuse Act 1990), Canada (Criminal Code s. 184 & s. 342.1), the European Union, and Australia. Before factory-resetting your phone, use a different phone's camera to photograph the unfamiliar Linked Devices, suspicious .APK permissions, and Account Login logs as admissible evidence for a restraining order or criminal prosecution.

Decision tree: diagnosing how your phone is being monitored¶

Use this technical triage flowchart to distinguish between Cloud/Account Mirroring, Commercial Stalkerware (.APK / MDM), Cellular Carrier Family Tracking, and Advanced Exploit Spyware:

flowchart TD
    A["Suspected Phone Surveillance: Texts Read, Calls Known, or Live Location Tracked"] --> B{"Is it physically safe to cut off the stalker's access right now?"}
    B -->|"No: Abuser is in the home or may retaliate violently"| C["Do NOT alter the monitored phone. Acquire a Cash-Purchased Prepaid Safe Phone on a Separate Cellular Network"]
    B -->|"Yes: Safe to audit and purge surveillance"| D{"What operating system does the phone run?"}
    D -->|"Apple iPhone (iOS)"| E["1. iOS xavfsizlik tekshiruvini ishga tushiring (Sozlamalar -> Maxfiylik va xavfsizlik -> Xavfsizlik tekshiruvi)"]
    E --> F["2. MDM profillari yoki konfiguratsiya sertifikatlari uchun Sozlamalar -> Umumiy -> VPN va Device Management ni tekshiring"]
    F --> G["3. WhatsApp/Signal bilan bogʻlangan qurilmalar, AirTag/Find My Alerts va umumiy mobil operator hisobini tekshirish"]
    G --> H{"Zero-Click Nation-State yollanma josuslik dasturidan (Pegasus / Predator) shubhalanasizmi?"}
    H -->|"Ha (jurnalist, dissident, ijrochi, yuqori xavfli maqsad)"| I["iOS blokirovkasi rejimini yoqing, har kuni qayta yoqing, tizim diagnostikasini suratga oling va MVT (Mobil tekshirish asboblar to‘plami) bilan skanerlang."]
    H -->|"Yoʻq (mahalliy/Stalkerware stsenariysi)"| J["Qurilma parolini o'zgartiring (6+ raqamli alfanumerik), Apple ID parolini o'zgartiring, 2FAni yoqing va agar Jailbreak bo'lsa, zavod sozlamalarini tiklash"]
    D -->|"Android (Samsung, Pixel, Motorola va boshqalar)"| K["1. Google Play Protect-ni yoqing (Play Store -> Profil -> Play Protect -> Scan)"]
    K --> L["2. Tekshirish sozlamalari -> Maxsus imkoniyatlar, Qurilma administratori ilovalari, bildirishnomalarga kirish va tepada paydo bo‘lish"]
    L --> M["3. WhatsApp/Google Messages veb-juftligini (`messages.google.com/web`) va Google joylashuvni almashishni tekshirish"]
    M --> N["Ikkinchi kamera yordamida dalillarni suratga olish, faqat oddiy fotosuratlar/kontaktlarni zaxiralash va zavod sozlamalarini to‘liq tiklashni amalga oshiring"]

Mobil kuzatuvning 4 bosqichini tushunish (ular qanday qilib kirishgan?)¶

Agar kimdir sizning shaxsiy suhbatlaringizdan aniq ma'lumotlarni bilsa yoki siz qayerda yurganingizni bilsa, vahima qo'zg'ash va ular g'ayritabiiy xakerlik qobiliyatiga ega deb o'ylash oson. Aslida, smartfon kuzatuvi to'rtta aniq texnik toifaga bo'linadi va maishiy, munosabatlar va ish joyidagi holatlarning 95 foizdan ortig'i 1-darajali, 2-bosqich yoki 3-darajaga to'g'ri keladi:

1-bosqich: iPhone (iOS / iPadOS) josuslik dasturlari va stalker dasturlarini bosqichma-bosqich tekshirish¶

Apple's iOS operating system enforces mandatory hardware-verified code signing and strict app sandboxing. An App Store app cannot secretly read your text messages, record your phone calls, or log your keystrokes outside its own app. Therefore, if someone is spying on your iPhone (assuming it is not visibly Jailbroken and you are not a target of a million-dollar government agency), they are using one of the seven specific iOS mechanisms below. Check every single one in order:

1. Apple-ni ishga tushiring Safety Check (iOS 16, 17, 18+)¶

1. Open Settings -> Privacy & Security -> scroll to the bottom and tap Safety Check.
2. Tap Manage Sharing & Access (if you want to inspect exactly who has access before cutting it off, so you can photograph it as evidence) OR tap Emergency Reset (to immediately cut off all sharing at once).
3. Inside Manage Sharing & Access, iOS shows you a unified forensic list of:
   • Every person you are sharing your Find My Location, Shared Photo Albums, Shared Calendars, Shared Notes, Shared Reminders, HomeKit Home, and Health Data with.
   • Every Shared Password (AirDrop / Passwords Family Sharing) group.
   • Every device signed into your Apple ID.

2. Inspect Settings -> [Your Name] for Secret Mirroring Devices (The "Hidden iPad" Trick)¶

1. Open Settings and tap [Your Name / Apple Account] at the very top.
2. Scroll all the way to the bottom to view your Device List.
3. What to look for: Look at every single iPhone, iPad, Mac, Apple Watch, or Windows PC listed. A very common domestic surveillance tactic is for a partner to take an old iPad or spare iPhone, sign it into your Apple ID using your phone passcode while you are asleep, turn off notifications on that iPad, and hide it in a drawer or briefcase. That hidden iPad receives every single iMessage, SMS (via Text Message Forwarding), photo, and live Find My ping in real time.
4. Tap any device you do not physically hold in your own possession right now and tap Remove from Account.
5. Next, go to Settings -> Apps -> Messages -> Text Message Forwarding (or Settings -> Messages -> Text Message Forwarding) and turn OFF any Mac or iPad listed there so standard green-bubble SMS texts are not mirrored to another screen.

3. Check for Rogue MDM (Mobile Device Management) Profiles and Root Certificates¶

While ordinary apps cannot spy on an iPhone, an enterprise Configuration Profile (.mobileconfig) yoki Mobil qurilmalarni boshqarish (MDM) profili yoki maxsus Root TLS sertifikati administratorga barcha internet-trafikingizni proksi-server orqali yo‘naltirish, qurilma joylashuvini kuzatish va shifrlangan veb-trafikni tekshirish imkonini beradi.

1. Sozlamalar -> Umumiy -> pastga aylantiring va VPN va qurilmalarni boshqarish-ga teging.
2. Bu erda nima bo'lishi kerak: Agar sizning iPhone ish beruvchingiz yoki maktabingizga tegishli bo'lmasa Mobile Device Management yoki Configuration Profiles ZERO profillari o'rnatilgan bo'lishi kerak (agar siz ProtonVPN yoki Mullvad kabini shaxsan o'rnatgan bo'lsangiz, faqat oddiy iste'molchi VPN ilovasi).
3. Agar siz oʻrnatmagan notanish MDM profili, “Ota-ona nazorati/Oila profili” yoki **“Tahlil/Beta profili”**ni koʻrsangiz, uni boshqa kamera bilan suratga oling va Boshqaruvni oʻchirish/Profilni oʻchirish tugmasini bosing.
4. Keyinchalik, yashirin O'rtadagi odam sertifikati mavjudligini tekshiring: Sozlamalar -> Umumiy -> Haqida -> Sertifikat ishonchli sozlamalari (pastki qismida) o'ting. ostida Enable Full Trust for Root Certificates, nol maxsus sertifikatlar yoqilgan bo'lishi kerak. Agar bittasi yoqilgan bo'lsa, uni darhol o'chiring va profilni o'chiring.

4. "Wi-Fi iTunes / Finder Backup Stalkerware" ni tekshiring (iMazing / Desktop Stalkerware Sync)¶

Qanday qilib tijorat stalkerware veb-saytlari (mSpy, Cocospy, Eyezy) "No-Jailbreak iPhone josuslik dasturini" taklif qilishni da'vo qilasizmi? Ular ikkita hiyla ishlatadilar: - Trick A (iCloud Backup Credential Scraper): Buzg‘unchi sizning Apple ID elektron pochtangiz, parolingiz va bir martalik 6 xonali 2FA kodini (siz uxlab yotganingizda qulflangan ekraningizdan olingan) stalkerware kompaniyasining bulut serveriga kiritadi. Har kecha soat 02:00 da iPhone oʻzining tungi iCloud Zaxira nusxasini yuklaganida, stalkerware serveri zahira nusxasini yuklab oladi va matnlar, WhatsApp maʼlumotlar bazasi, rasmlar va qoʻngʻiroqlar tarixini chiqarib oladi. - Qanday qilib hiyla-nayrangni bir zumda o'ldirish mumkin: Apple ID parolingizni o'zgartiring, notanish Ishonchli telefon raqamlarini o'chirib tashlang. Settings -> [Your Name] -> Sign-In & Securityva iPhone 6 xonali ekran qulfi parolini o‘zgartiring (Settings -> Face ID & Passcode -> Change Passcode). - B hiylasi (Mahalliy Wi-Fi-ni bitta uy tarmog‘idagi noutbuk bilan sinxronlash): Siz dushda bo‘lganingizda, foydalanuvchi qulfdan chiqarilgan iPhone-ni Windows shaxsiy kompyuteri yoki MacBook-ga USB kabeli orqali 2 daqiqa davomida ulaydi, parolingiz yordamida “Bu kompyuterga ishoning” tugmasini bosing va iTunes/Finder (yoki tijorat yorlig‘i bilan o‘rnatilgan iPhone yorlig‘i) orqali ushbu belgini belgilab qo‘yadi. Wi-Fi"**. O'sha kundan boshlab, siz har safar uyga kirganingizda va sizning iPhone uy Wi-Fi tarmog'iga ulanganda, ularning noutbuki hech qachon kabelga ulanmasdan, Wi-Fi orqali butun iPhone-ning to'liq sud-zaxirasini jimgina tortib oladi. - Qanday qilib Trick B-ni bir zumda o'ldirish mumkin: Hatto Apple ID parolingizni o'zgartirish ham mahalliy USB/Wi-Fi kompyuter ishonchli ulanishini bekor qilmaydi. Butun telefoningizni asl holatiga qaytarmasdan iOS’dagi barcha ishonchli kompyuterlarni o‘chirish uchun Sozlamalar -> Umumiy -> iPhone o‘tkazish yoki qayta o‘rnatish -> Qayta tiklash -> Joylashuv va maxfiylikni tiklash bo‘limiga o‘ting (yoki parolingizni o‘zgartiring va O‘g‘irlangan qurilma himoyasini yoqing; kompyuterga ulang va Sinxronizatsiya tarixini qayta o‘rnating yoki to‘liq Barcha tarkibni va sozlamalarni butunlay o‘chirib tashlang lockdownd juftlik sertifikatlari).

5. Uchinchi tomon joylashuv ilovalarini tekshiring (Google Maps, Life360, Snapchat Snap Map, Strava)¶

Appleniki Safety Check Apple-ning asl nusxasini tiklaydi Find My joylashuvni ulashish, lekin suiisteʼmolchi siz har kuni foydalanadigan uchinchi tomon ilovasida doimiy 24/7 joylashuv maʼlumotlarini almashishni yoqgan boʻlishi mumkin: 1. iPhone yoki Android’dagi Google Xaritalar: Google Xaritalar ilovasini oching -> Profil rasmingizni (yuqori o‘ngda) bosing -> Joylashuvni ulashish-ga teging. hech kim 24/7 jonli Google Xaritalar joylashuvingiz oqimini olayotganini tasdiqlang. 2. Har bir ilovani tekshirish "Always" Joylashuvga ruxsatnoma: Sozlamalar -> Maxfiylik va xavfsizlik -> Joylashuv xizmatlari bo‘limiga o‘ting. Barcha ilovalar roʻyxatini pastga aylantiring va belgilangan ilovani qidiring Always. Har bir ilovani oʻzgartiring Always ga While Using the App yoki Never. 3. Yashirinni tekshiring Keyboard Kengaytmalar (uchinchi tomon klaviaturalari): Sozlamalar -> Umumiy -> Klaviatura -> Klaviaturalar ga o'ting. Bu faqat ro'yxat bo'lishi kerak English (yoki ona tilingiz) va Emoji. Agar siz uchinchi tomon klaviaturasini ko'rsangiz Allow Full Access yoqilgan, uni darhol o'chirib tashlang.

2-bosqich: Toʻliq bosqichma-bosqich Android josuslik dasturlari va stalker dasturlari (APK) audit¶

Chunki Android foydalanuvchilarga dastur paketlarini oʻrnatish imkonini beradi (.APK fayllar) to'g'ridan-to'g'ri Google Play do'konidan tashqaridagi veb-brauzerlardan, tijorat stalkerware (mSpy, FlexiSPY, Hoverwatch, uMobix, TheTruthSpy, KidsGuard Pro, Spyic) iOS-ga qaraganda Android-da haqiqiy o'rnatilgan fon dasturi sifatida sezilarli darajada keng tarqalgan.

Buzg‘unchi Android telefoniga stalker dasturini o‘rnatsa, o‘rnatuvchi suiiste’molchidan Google Play Protect’ni o‘chirishni, Maxsus imkoniyatlar xizmati/qurilma administratori/Bildirishnomaga kirish ruxsatlarini berishni taklif qiladi, so‘ngra ** kabi soxta tizim nomi ostida Sozlamalar menyusida niqoblangan holda bosh ekrandagi ilovalar tortmasidan o‘z belgisini yashiradiSystem Service**, Update Service, Google Framework Service, Wi-Fi Helper, yoki Device Health.

Ushbu 6 bosqichli Androidni aniqlash va olib tashlash ketma-ketligiga rioya qiling¶

1. 1-qadam: Tekshiring va qayta yoqing Google Play Protect Immediately:
   • Every commercial Android stalkerware installation guide instructs the abuser to turn off Google Play Protect as Step 1, because Play Protect detects and auto-disables known commercial stalkerware signatures.
   • Open the Google Play Store app -> tap your Profile icon (top right) -> tap Play Protect -> tap the Settings (Gear icon) in the top right corner.
   • If Scan apps with Play Protect is toggled OFF, that is a massive red flag that someone manually disabled your phone's anti-malware shield to sideload stalkerware. Photograph that screen with a second camera, toggle Scan apps with Play Protect back ON, and run a manual scan.
2. Step 2: Audit Accessibility Services (Where Android Keyloggers Live):
   • Android locks apps inside sandboxes too, so how does an Android stalkerware app read your WhatsApp/Signal chats and record every keystroke you type? By abusing Android's Accessibility API (originally designed to read the screen aloud for visually impaired users).
   • Open Settings -> Accessibility -> look under Downloaded Apps / Installed Apps / Installed Services.
   • What should be here: Unless you personally use a screen reader or password manager autofill via Accessibility, zero unfamiliar apps should have Accessibility turned on. If you see an unfamiliar service named System Update, Sync Service, Security Service, yoki Device Health with Accessibility toggled ON, photograph it and toggle it OFF immediately.
3. Step 3: Audit Device Admin Apps (Why You Can't Click "Uninstall" on Stalkerware):
   • Stalkerware registers itself as a Device Administrator so that if you try to uninstall it, the "Uninstall" button is grayed out.
   • Open Settings -> Security & Privacy (or Biometrics and Security) -> More Security Settings -> Device Admin Apps (or simply type Device admin apps into the top search bar of your Settings app).
   • Look at every app checked. Only Find My Device (or your employer's work profile app) should be active. If you see a generic-sounding app enabled as a Device Admin, uncheck / deactivate it first, once deactivated here, its Uninstall button in the main App list will unlock.
4. Step 4: Audit Notification Access va Appear on Top (Draw Over Other Apps):
   • Open Settings -> Apps -> Special App Access (on Samsung: Settings -> Apps -> Three-dot menu -> Special access).
   • Tap Notification access (or Device & app notifications): Any app toggled ON here can silently read the full text of every incoming SMS, WhatsApp, Signal, and email notification and even auto-dismiss security alerts before your screen lights up. Turn off anything unfamiliar.
   • Go back and tap Appear on top (or Display over other apps) and Media projection: Stalkerware uses these to capture silent screenshots and overlay invisible keylogging windows.
5. Step 5: Inspect the Complete All Apps List (Sorted by Size or Install Date):
   • Open Settings -> Apps -> See all apps.
   • Tap the Three-dot menu (top right) and select Show system (only after checking the regular user apps list first.).
   • In the regular user app list (with Show system turned OFF), scroll slowly from top to bottom. Stalkerware cannot hide from Settings -> Apps even when it hides its icon from your home screen. Look for any app with:
     • A blank white icon, a generic green Android robot icon, or a gear icon named System Update, Settings, Backup, SyncService, CoreService, yoki com.android.system.. appearing in the User/Downloaded apps list.
     • Tap the suspicious app -> scroll to the very bottom of its App Info page and read the line: App installed from... Genuine system apps and legitimate apps say Installed from Google Play Store or come pre-installed on the read-only /system partition. If it says Installed from Chrome, Installed from Files / My Files, yoki Package installer, someone manually downloaded and sideloaded that .APK file onto your phone.
6. Step 6: Check Google Messages for Web va Google Account Activity:
   • Open the default Messages (Google Messages) app on your Android phone -> tap your Profile icon (top right) -> tap Device pairing.
   • If you see any paired computer (Chrome on Windows, MacOS, etc.), someone scanned your QR code at messages.google.com/web and is reading and sending your SMS/RCS texts live from their browser. Tap Unpair all devices immediately.

Phase 3: Checking your Messaging Apps, Home Wi-Fi, and Cellular Carrier Plan¶

Even if your phone hardware is 100 percent clean, an attacker can intercept your communications through three external layers:

1. Audit Every Messaging App's Linked Devices Menyu (60 soniya davom etadi)¶

Modern end-to-end encrypted messaging apps allow linking up to 4 or 5 companion desktop browsers or tablets via a quick QR code scan. Check all four of these apps right now: - WhatsApp: Sozlamalar -> Bog‘langan qurilmalar-ga teging. Siz tanimagan har qanday seansdan chiqing. Shuningdek, Sozlamalar -> Suhbatlar -> Chatni zaxiralash bo‘limiga o‘ting va kimdir notanish hisobning shifrlanmagan zaxira nusxasini yoqganligini tekshiring va Ikki bosqichli tasdiqlash PIN-kodini yoqing (Settings -> Account -> Two-step verification). - Signal: Tap your Profile Icon (top left) -> Settings -> Linked Devices. Remove any unfamiliar Signal Desktop yoki iPad instance. - Telegram: Tap Settings -> Devices (Active Sessions). Tap Terminate All Other Sessions if you see any unfamiliar city, PC, or web browser, and check Settings -> Privacy and Security -> Two-Step Verification. - Instagram / Facebook Messenger / Snapchat: Open Settings -> Accounts Center -> Password and security -> Where you're logged in, and log out of all unfamiliar phones or desktop browsers.

2. Understand What Your Cellular Carrier Bill Reveals on a Shared Family Plan¶

If your phone number is on a Shared Family Plan where a spouse, partner, parent, or employer is the Primary Account Holder (or has the login to att.com, verizon.com, t-mobile.com, rogers.com, yoki vodafone.co.uk): - What the Primary Account Holder Can ALWAYS See on the Carrier Website: - Even without touching your phone, the Primary Account Holder can download the Detailed Monthly Call & SMS Usage Log PDF. While the text content of your SMS messages is usually not shown on standard bills, the carrier log lists every single 10-digit telephone number you called or texted, the exact date and minute of the call/text, and the exact duration of every phone call. - Therefore, if you call a domestic violence hotline, a divorce attorney, a real estate agent, or a friend using a standard cellular phone call on a shared family plan, that phone number will print right on the carrier web portal within minutes. - How to Communicate Privately If You Are Stuck on a Shared Carrier Plan: - Never place regular cellular voice calls or send regular SMS/MMS texts to sensitive numbers from a shared-plan phone. - Instead, calls and messages made inside Signal, WhatsApp, FaceTime Audio, or a web browser over cellular data (especially with a trusted VPN like ProtonVPN or Mullvad active) show up on the carrier bill only as generic encrypted internet data megabytes (15.4 MB Web Data), never revealing who you called or messaged.

Phase 4: Detecting Zero-Click Mercenary Spyware (Pegasus / Predator) for High-Risk Targets¶

If you are an investigative journalist, human rights defender, political dissident, senior government official, defense contractor, or corporate executive and suspect you have been targeted by advanced nation-state mercenary spyware (such as NSO Group's Pegasus or Intellexa's Predator):

1. Why Standard Manual Checks Don't Find Pegasus: Unlike $29/month consumer stalkerware (mSpy), zero-click mercenary spyware does not appear in Settings -> Apps yoki Accessibility. It exploits zero-day vulnerabilities in iMessage, FaceTime, WhatsApp, or WebKit to execute code directly in system memory (RAM).
2. Immediate Defense 1: Reboot Your Phone Every Single Morning:
   • Research by Amnesty International's Security Lab and Citizen Lab (University of Toronto) revealed that to evade forensic detection on modern iOS devices (where the root file system is cryptographically sealed read-only via Apple's Signed System Volume), modern Pegasus payloads often operate in-memory only (non-persistent).
   • Shutting down and restarting your iPhone or Android completely every 24 hours wipes volatile RAM and forces the attacker to risk firing a brand-new zero-day exploit to re-infect the phone.
3. Immediate Defense 2: Enable Apple Lockdown Mode or Android Advanced Protection:
   • On iPhone (iOS 16+): Sozlamalar -> Maxfiylik va xavfsizlik -> Bloklash rejimi -> Bloklash rejimini yoqish ga o‘ting. Bloklash rejimi ko'pgina xabarlar qo'shimchalari turlarini bloklash, murakkab WebKit Just-In-Time-ni o'chirib qo'yish orqali qurilmani qattiqlashtiradi (JIT) JavaScript compilers, blocking incoming FaceTime calls from numbers you have not previously called, and blocking wired USB data connections while locked. (To date, Citizen Lab and Amnesty International have documented that Lockdown Mode successfully blocks known zero-click iMessage exploit chains).
4. How to Perform a True Forensic Check (MVT: Mobile Verification Toolkit):
   • Never pay scam websites or random cybersecurity apps claiming to "scan for Pegasus".
   • Instead, use MVT (Mobile Verification Toolkit), the free, open-source forensic tool created and maintained by Amnesty International (docs.mvt.re). MVT analyzes an encrypted iTunes/Finder backup and sysdiagnose log (or Android adb bugreport) on a Linux or macOS computer against regularly updated Indicators of Compromise (IoCs) (Shutdown.log anomalies, DataUsage.sqlite jarayon arvohlar va zararli domen artefaktlari).
   • Agar siz jurnalist, faol yoki fuqarolik jamiyati aʼzosi boʻlsangiz, toʻgʻridan-toʻgʻri Access Now ning 24/7 raqamli xavfsizlik ishonch telefoniga (accessnow.org/help) yoki Xalqaro Amnistiyaning xavfsizlik laboratoriyasi.

Tez-tez beriladigan savollar¶

Manbalar tekshirildi¶

• National Network to End Domestic Violence (NNEDV, United States): Safety Net Project: Technology Safety & Stalkerware Triage Guidelines for Survivors (techsafety.org).
• Cybersecurity and Infrastructure Security Agency (CISA) & National Security Agency (NSA, United States): Mobile Device Best Practices: Mitigating Spyware, Spear-Phishing, and Zero-Click Exploits (cisa.gov).
• Apple Platform Security & Support (United States): Safety Check on iPhone (iOS 16/17/18) User Guide and Lockdown Mode Technical Specification (support.apple.com/guide/personal-safety).
• Google Safety Center & Android Security (United States): Google Play Protect Stalkerware Detection, Unknown Tracker Alerts, and Accessibility Permission Auditing (support.google.com/android).
• Coalition Against Stalkerware (International): Indicators of Compromise, Forensic Preservation Before Removal, and Survivor Safety Planning (stopstalkerware.org).
• Amnesty International Security Lab & Citizen Lab at the University of Toronto (International): Mobile Verification Toolkit (MVT) Documentation and Forensic Methodology for Detecting Pegasus / Mercenary Spyware (docs.mvt.re, citizenlab.ca).
• National Cyber Security Centre (NCSC) & Refuge Tech Safety (United Kingdom): Guidance on Spotting and Removing Spyware and Securing Shared Accounts (ncsc.gov.uk, refugetechsafety.org).

Tegishli qo'llanmalar¶

• GPS tracker and AirTag stalking
• Smart home hack, camera hijacking, and stalkerware
• Oiladagi zo'ravonlik
• Oiladagi zo'ravonlikni tiklash va xavfsizlik rejasi
• Stalking and physical surveillance defense
• Buzilgan elektron pochta hisobi: yashirin uzatish qoidalari va tiklash