iPhone Malware Scan

iPhone malware/spyware assessment

This skill performs a full forensic assessment of a non-jailbroken iPhone connected to a Mac over USB. It is defensive/diagnostic: the user owns the device. All scripts live in scripts/ next to this file.

What it can and cannot do (state this to the user)

• iOS sandboxing means no app can read another app's memory, and mandatory code signing means a foreign dylib cannot be injected into an app without a jailbreak. So "build an app to inspect WhatsApp" is not possible — the real check is a forensic backup scan, which this skill automates.
• MVT matches against known spyware indicators. A clean result is strong evidence but cannot prove the absence of an unknown zero-day. Say this.

Prerequisites

• macOS with Homebrew installed.
• An iPhone + USB cable. The user must unlock the phone, tap Trust, and keep it unlocked and awake during the backup (Auto-Lock → Never).
• A backup password. If backup encryption is not already enabled, this skill turns it on with a password the user provides — capture it and warn them it cannot be recovered if lost.

How to run it

Prefer the orchestrator, driven from this skill folder (scripts/ is alongside this file):

BACKUP_PASSWORD='' \
WORKDIR="$PWD/iphone-assessment" \
  zsh scripts/run-all.sh

The backup and decrypt steps can each take a long time and produce tens of GB. Run long steps in the background and monitor for completion (watch for Manifest.db appearing under WORKDIR/backup//).

Running step by step (when you need control or a step fails)

1. zsh scripts/01-preflight.sh — install/upgrade libimobiledevice + MVT, fetch latest IOCs.
2. zsh scripts/02-pull-crashlogs.sh "$WORKDIR" — pull .ips crash logs (non-destructive).
3. BACKUP_PASSWORD=... zsh scripts/03-backup.sh "$WORKDIR" — full encrypted backup, auto-resumes on lock/disconnect.
4. BACKUP_PASSWORD=... zsh scripts/04-decrypt.sh "$WORKDIR" — decrypt for scanning.
5. zsh scripts/05-scan.sh "$WORKDIR" — MVT check-backup + explicit check-iocs across all feeds.
6. python3 scripts/06-analyze-crashes.py "$WORKDIR/crashlogs" WhatsApp — foreign-dylib / abnormal-kill scan.
7. python3 scripts/07-assess.py "$WORKDIR/mvt-results" --json "$WORKDIR/assessment-summary.json" — final report.

Handling the common failures

• Error Code 208: Device locked during backup → the phone locked. Tell the user to unlock it and set Auto-Lock → Never; step 3 retries automatically.
• Could not receive from mobilebackup2 (-4) → USB dropped / device slept. Reconnect; step 3 resumes from what was already transferred.
• Backup has no Manifest.db → it did not finish; it is unusable for scanning. Re-run step 3 to completion.

Interpreting results (how to report to the user)

• Real IOC match = an entry in a *_detected.json with a non-null matched_indicator. This is the only thing that indicates known spyware. Treat any as serious; direct the user to Amnesty's Security Lab.
• Heuristic notes (e.g. "Lockdown mode disabled") have matched_indicator: null — these are context/hardening advice, NOT detections.
• The assessment (step 7) separates these automatically and prints a verdict, plus the full-manifest file sweep (unknown domains, jailbreak/hook artifacts, dylibs outside app bundles) and a coverage table proving what was examined.

Cleanup

WORKDIR/backup and WORKDIR/decrypted hold the user's personal data and can be very large. Offer to delete them when finished; never delete without asking. The mvt-results/ JSON is small and safe to keep for review.