How to Detect Spyware on iPhone Without Installing an App

If you are reading this, something has probably already made you uneasy. A battery that dies by lunchtime. A partner who knows things you never told them. A phone that felt warm in your pocket overnight. You went looking for an app that could scan your iPhone and tell you the truth, and you found dozens of them in the App Store.

Here is the part nobody selling those apps wants to explain: on an iPhone, they cannot do what you think they are doing.

Why iPhone antivirus apps cannot find spyware

iOS puts every app in a sandbox. An app can see its own files and nothing else. It cannot read another app's data, it cannot list the processes running on your phone, and it cannot inspect system files. That design is one of the reasons iPhones are hard to infect in the first place, and it is genuinely good for you.

But it cuts both ways. The same wall that stops a malicious app from reading your banking app also stops a security app from finding the malicious app. There is no such thing as a full system scan on iOS, because Apple does not permit one to exist. Any App Store product marketed as an iPhone virus scanner is, at best, checking your Wi-Fi settings, warning you about bad websites, and telling you your iOS is out of date.

This matters most for exactly the threats you are worried about. Mercenary spyware such as Pegasus exploits flaws deep in the operating system, at a level no sandboxed app can observe. A tool running inside the sandbox is looking for a burglar while locked in a cupboard.

So if you cannot scan from the phone, what can you actually do?

Five checks you can do yourself in ten minutes

None of these are conclusive. All of them are worth doing, and several have caught real intrusions.

1. Look for an Apple threat notification

Apple watches for state-grade spyware campaigns and warns people it believes were targeted. Since 2021 it has notified users in more than 150 countries; one campaign in April 2024 alone reached people in 92 countries.

Sign in at account.apple.com and look for an alert banner at the top of the page. Apple also sends notification emails and iMessages to the addresses on your Apple ID.

One critical caveat: because these notifications are frightening and well known, they are a favourite disguise for scams. A genuine Apple threat notification never asks you to click a link, install anything, open a file, or hand over your password. If a message does any of that, it is not from Apple. Check by signing in to account.apple.com yourself, typing the address by hand.

2. Check for configuration profiles

A configuration profile is a legitimate iOS feature that lets an employer or school manage a device. It is also one of the few supported ways to get persistent surveillance onto an iPhone without exploiting it, which is why commercial stalkerware sometimes asks a person to install one while they have your phone in their hands.

Go to Settings, then General, then VPN and Device Management. On a normal personal iPhone this screen is empty, or contains only profiles you recognise from your employer. Anything you do not recognise deserves an explanation before you remove it.

3. Audit what your apps are allowed to see

Go to Settings, then Privacy and Security, and work through Location Services, Microphone, Camera, Photos, and Contacts. You are not looking for spyware here. You are looking for ordinary apps with extraordinary permissions, because the most common form of phone surveillance is not exotic malware at all. It is a family-sharing app, a photo backup service, or a note-taking tool that someone installed and quietly pointed at their own account.

While you are there, open Settings, then your name at the top, and check the list of devices signed in to your Apple ID. A device you do not recognise means someone can read your iCloud backups, and that includes your messages.

4. Look for signs of a jailbreak

Most persistent iPhone spyware needs a jailbroken device. If your phone was jailbroken without your knowledge, you may find an app you never installed named Cydia, Sileo or Zebra. Search your phone for those names. Their presence is not proof of spying, but it is proof that someone removed Apple's protections from your device.

5. Compare battery and data against your habits

Open Settings, then Battery, and look at the last ten days. Then Settings, then Mobile Data, and scan the per-app totals. You are looking for something that does not match how you actually use your phone: an app you never open near the top of the battery list, or background data measured in gigabytes.

Treat this as the weakest signal of the five. A failing battery, an iOS update, or a photo library syncing after a holiday will all produce the same pattern. Unexplained consumption is a reason to look closer, not a verdict.

What these checks cannot tell you

Everything above happens inside the sandbox, which means everything above can be defeated by anything sophisticated. Zero-click spyware leaves no icon, requests no permission, and asks you to tap nothing. It can be installed by a message you never opened, and on some variants it does not survive a reboot at all, which makes it harder still to catch in the act.

Traces do exist. They are just not in places iOS lets an app look. They sit in crash logs, in databases that record which processes used the network and when, in a small system file that records shutdowns, and in the metadata inside an encrypted backup. Reading them requires stepping outside the sandbox, and there is only one practical way to do that.

How analysis from a computer works

Connect the iPhone to a computer by cable and the phone will produce a full backup, along with diagnostic data that no on-device app is permitted to read. That backup can then be examined against known indicators of compromise: domains that mercenary spyware is known to contact, process names it creates, artefacts it leaves behind.

This is the method used by the researchers who actually catch these campaigns. Amnesty International's Security Lab publishes an open-source tool called the Mobile Verification Toolkit that does precisely this, and it was the basis of the Pegasus Project investigation in 2021. It is free, it is well regarded, and it is a command-line tool that assumes you are comfortable installing Python packages and interpreting forensic output.

That last part is the honest catch. The method is sound and the tooling is public, but the gap between a worried person and a working forensic analysis is wide. Closing that gap is what Haris Shield is for: the same class of external, backup-based analysis, with a report you can read without a terminal.

If you find something, read this before deleting it

This is the most important section of this article, and it is the one most guides skip.

If you suspect that the person monitoring you is someone in your life, a partner, an ex, a family member, an employer, then removing the spyware is not obviously the first move. Many stalkerware products alert whoever installed them the moment they are disabled. In a controlling or abusive situation, the moment your monitoring stops is the moment the person watching knows you found it. That escalation is a documented risk, not a hypothetical one.

The Coalition Against Stalkerware, which brings together domestic violence organisations and security companies, is explicit about this: deleting stalkerware also deletes the evidence, and that evidence may matter if you go to the police.

A safer order of operations:

1. Do nothing on the phone yet. Do not confront anyone.
2. Get advice first, from a device the other person has never had access to. A domestic violence organisation can help you plan the sequence.
3. Document what you found. A forensic report is worth more than a screenshot.
4. Change passwords and enable two-factor authentication from a different device, not from the phone you suspect.
5. Only then decide about removal, ideally with support in place.

If you are not in that situation, and the intrusion looks like ordinary crime or an unknown attacker, the calculus is simpler. Update iOS, remove what you found, change your Apple ID password, and consider a factory reset without restoring the suspect backup.

Making yourself a harder target

• Turn on Lockdown Mode if you have real reason to think you are targeted. It is in Settings, Privacy and Security, and it disables the message attachment types and web features that these exploits rely on. Apple has said it is not aware of any successful mercenary spyware attack against a device with Lockdown Mode enabled. Some things break, which is the point.
• Install iOS updates the day they arrive. Most of these campaigns depend on flaws that Apple has already patched.
• Use a passcode nobody else knows, and check that no extra Face ID or Touch ID entries have been added.
• Do not jailbreak, and do not let anyone else do it for you.
• Audit your Apple ID devices every few months.

The short answer

You cannot scan an iPhone for spyware from the iPhone. Anything claiming otherwise is limited by a sandbox it cannot escape. What you can do yourself is check for Apple threat notifications, unexpected configuration profiles, over-permissioned apps, jailbreak artefacts, and consumption that does not match your habits. Beyond that, the only real answer is analysis from a computer.

And if you find something and someone in your life may be behind it, get advice before you touch anything. The scan is the easy part.

Sources

• Apple, About Apple threat notifications and protecting against mercenary spyware: support.apple.com/en-us/102174
• Amnesty International Security Lab, Forensic Methodology Report: How to Catch NSO Group's Pegasus: amnesty.org
• Mobile Verification Toolkit: mvt.re
• Coalition Against Stalkerware, Information for survivors: stopstalkerware.org/information-for-survivors