Mobile Malware · Detection & Defense · Lesson 3 of 5

Responding to an Infected Phone

Run a calm response to a compromised phone, at work or at home.

A response plan, step by step

In Android App Security you cleaned up a phone yourself. At a company, a suspected infection becomes an incident, an event the security team handles with a written plan. NIST's incident response guide (SP 800-61 Rev. 3, 2025) is a common reference. For a phone, the plan usually runs in this order.

• Isolate. Cut the phone off from company data. Conditional access can block work services right away, and IT can sign the phone out of company accounts or turn on airplane mode. The goal is to stop the malware from reaching more data.
• Preserve, if needed. If the company may investigate, report to police or face legal questions, the phone is evidence. You saw in Mobile Forensics why a powered-on phone should stay on, and why it should be isolated rather than wiped. A quick factory reset feels tidy, but it destroys the traces an investigator needs. Note what you saw, when and on which phone.
• Reset credentials from a clean device. Assume anything the phone touched may be known to the attacker: email, VPN, chat, and the one-time codes it received. Change passwords and sign out other sessions from a computer or phone you trust.
• Remove. Once evidence is collected, or the team decides none is needed, remove the malware. On a company phone, that often means a full wipe and fresh setup through MDM, since it's faster and more certain than hunting for leftovers.
• Monitor. Watch the employee's accounts for odd logins, new mail forwarding rules or unexpected payments for the following weeks.

A personal phone follows the same logic on a smaller scale. Turn on airplane mode, change your email password first from another device, call your bank if money was involved, then remove the app or reset as you learned earlier. Preserving evidence matters less here, unless you plan to report a crime, or you suspect stalkerware placed by someone you know. In that case, removing it may alert that person, so a support service should help you plan first.

Checking for spyware traces

Most infected phones carry common malware: trojans, adware or stalkerware that ordinary tools and steps can handle. Mercenary spyware, as you saw in iOS Internals, is rare and aimed at a small number of people such as journalists and activists. Checking for it takes different tools.

The best-known is the Mobile Verification Toolkit (MVT), released by Amnesty International's Security Lab in July 2021 alongside the Pegasus Project and still maintained by Amnesty and other contributors. Conceptually, it works in three steps:

• Collect. It reads records an expert has gathered from the phone, such as an encrypted iPhone backup or data pulled from an Android phone over a USB debugging connection.
• Parse. It pulls out records from system databases, logs and diagnostic data, the places where spyware can leave traces like suspicious links, process names or domain lookups.
• Compare. It checks those records against published indicators of compromise (IoCs), the known fingerprints of specific spyware, and builds a timeline of anything that matches.

Its documentation is careful about limits. MVT is a research tool for technologists and investigators, not a button for ordinary users. Public indicators can't prove a phone is clean, because new spyware may leave traces nobody has published yet, so a result of no matches can give false confidence. Its license also forbids analyzing a phone without its owner's consent. MVT is for helping someone check their own device, never for snooping on someone else's.

So when should a regular person or a company call in experts?

• The person received a real Apple threat notification.
• They are a journalist, activist, lawyer or politician and see signs of targeting, such as odd links from unknown senders.
• The company suspects a targeted attack on executives, beyond everyday malware.

For civil society, Access Now's Digital Security Helpline is free, runs around the clock and works in about ten languages. MVT's own documentation points people there, or to Amnesty's Security Lab. Companies typically turn to an incident response firm.