Pegasus-style spyware, stalkerware, monitored phones
Private phone spyware checks
If you are a public figure, run a business, work in law or the media, or are going through a high-conflict separation, an antivirus app won't tell you whether your phone is being watched. We run a forensic check with the Mobile Verification Toolkit (MVT), review your accounts and settings with you, and give you a written report.
Forensic, not guesswork
MVT compares data from your phone against published traces of known spyware such as Pegasus and Predator.
Accounts and sharing
Apple ID or Google devices, sign-ins, device-management profiles, monitoring apps, location sharing and email forwarding.
Locked down afterwards
Updates, passkeys, two-step verification and, where it fits, Apple's Lockdown Mode, explained so you can keep it that way.
Who this is for
- Politicians, public figures and their staff
- Business owners and senior executives, especially during a deal, dispute or restructure
- Lawyers, journalists and advocates who hold sensitive information
- People in a high-conflict separation, or who believe they are being stalked or monitored
- Anyone who has received a threat notification from Apple
Most people worried about a "hacked phone" have a hacked account, and our guide to checking your phone covers that. This page is for people with a real reason to think someone may have invested in watching them.
What MVT is, and what it isn't
The Mobile Verification Toolkit is an open-source forensic tool maintained by Amnesty International's Security Lab, first released for the Pegasus investigations. It looks through the data a phone keeps about itself (an encrypted backup of an iPhone, or a collection taken from an Android phone) for traces that researchers have linked to known spyware.
- It is a forensic tool, not an app. The project itself says it is meant for trained practitioners, not for people to check themselves.
- It finds known traces. It compares against indicators published by Amnesty and other researchers, so the newest spyware may not have published indicators yet.
- A clean result is reassuring, not proof. We will tell you plainly what was checked and what a clean result can and can't rule out.
- iPhones usually leave more to examine than Android phones, which is one reason most confirmed Pegasus cases have involved iPhones.
What the check involves
- A confidential conversation first: what you have noticed, why you are worried, and who might be involved. That decides what we look at
- With your consent and with you present, an encrypted backup or data collection is taken from the phone. You unlock the phone and choose the backup password
- The data is analysed on our own offline computer with MVT and the latest published indicators
- We review your Apple ID or Google account devices and sign-ins, device-management profiles, monitoring and remote-access apps, location sharing, email forwarding and recovery details
- We explain what we found in person, and give you a written report: what was checked, what was found, what was changed, and the limits of the check
- We help you lock things down: updates, passkeys, two-step verification and, where it suits how you use your phone, Lockdown Mode
If something is found
Don't wipe the phone straight away. It may be evidence, and wiping it can tell whoever is behind it that you know. We help you decide the next step with the right people: the police or ReportCyber (cyber.gov.au), your lawyer, and for civil society, journalists and human rights defenders, the free Digital Security Helpline run by Access Now. If a partner or ex-partner may be involved, 1800RESPECT (1800 737 732) gives free, confidential advice.
If you have received an Apple threat notification
Apple sends these to people it believes have been individually targeted by mercenary spyware. Take it seriously. Follow Apple's instructions, turn on Lockdown Mode, and keep the phone as it is. We can come to you, make the forensic backup and go through the rest of this check, and work alongside Access Now's helpline if you contact them.
More than one device?
Spyware worries rarely stop at one phone. The check can include a second phone, a tablet, a laptop and your home or office Wi-Fi, in the same order we use for our whole-home security checks.
Price
Every situation is different, so we quote after the first conversation, based on how many devices and accounts are involved. The price is fixed before we start.
Rapid Tech Solutions is an independent local business. We are not affiliated with Amnesty International, Access Now or Apple; MVT is their open-source tool and their published research.
Phone spyware checks — common questions
Can MVT prove my phone is clean?
No tool can. MVT finds traces of known spyware. A clean result means none of the published traces were found, which is reassuring, but brand-new spyware may not have published indicators yet. We explain exactly what was checked.
Do you need my passcode?
You unlock the phone yourself so it can make the backup, and you choose the backup password. We don't need to know your passcode, and you stay with the phone while the backup is made.
Does it work on Android phones?
Yes. Android phones are checked with a data collection tool and then MVT, but they usually keep fewer traces than iPhones, so the check is less thorough.
How is this different from your whole-home security check?
The whole-home check covers every device, your router and your accounts. This adds a forensic scan for targeted spyware and a closer look at the phone, for people with a specific reason to think they are being watched.
Do you remove spyware?
If spyware is found, preserving the evidence comes first. After that the usual answer is to replace or reset the phone and secure every account, and we help with both, alongside the police, your lawyer or Access Now as appropriate.
Ready to get it sorted?
Call to describe the fault, or send a booking request if we cannot answer. We confirm the service option, time and quote with you before work starts.