How to Check an iPhone for Spyware (2026)

How do I check my iPhone for spyware?

The short answer

Most likely threat: not a hidden app — iOS’s sandbox makes classic stalkerware apps hard. It’s usually someone with your Apple ID password reading your iCloud. Change it and turn on two‑factor authentication first.

Quick checks: remove unknown configuration profiles / MDM (Settings ’ General ’ VPN & Device Management), review devices on your Apple ID, run Safety Check, and watch for an unexpected profile or a supervised‑device banner.

High risk (journalist, activist, targeted): use Apple’s Lockdown Mode and, for a real forensic check, Amnesty’s MVT MVT (mvt-project).

In danger? Don’t tip the person off. Reach a domestic‑violence advocate or the Access Now Helpline first.

Two very different threats

1. iCloud / Apple ID access (common). If someone knows your Apple ID and password, they can see your location (Find My), photos, messages in iCloud and backups from any browser — no app on your phone, nothing to find by scanning. This is the usual “my ex is tracking me” case. The fix is account security, not malware removal.

2. Mercenary spyware (rare, severe). Pegasus (NSO Group), Predator (Intellexa), RCS Lab and similar are sold to governments and used against specific people, often through zero‑click exploits that leave little trace. Ordinary users are not targets; journalists, activists, lawyers and dissidents can be. This needs the forensic route below, not a settings check. Citizen Lab

What iOS makes hard: Apple’s sandbox stops one app from reading another’s data, so the openly‑sold “monitor any phone” stalkerware common on Android mostly can’t work on a normal iPhone. On iOS it usually needs your iCloud login, a jailbroken device, or a configuration profile / MDM enrolment.

Checks anyone can do in five minutes

Configuration profiles & MDM. Settings ’ General ’ VPN & Device Management. If you did not add a profile or your phone is not managed by a school or employer you trust, an unknown profile here is a red flag — it can route traffic or enforce monitoring. Remove it. Apple: profiles
Apple ID devices. Settings ’ [your name] ’ scroll to the device list. Remove any device you don’t recognise, then change your Apple ID password and turn on two‑factor authentication.
Safety Check. Settings ’ Privacy & Security ’ Safety Check (iOS 16+) lets you review and stop sharing location and access with specific people in one place. Apple: Safety Check
Find My sharing. Find My ’ People — see who you share location with and stop it.
Battery & data. Settings ’ Battery and Cellular — a process you don’t recognise using a lot of both can be a hint, though it is weak evidence.
Supervision banner. “This iPhone is supervised and managed by…” at the top of Settings means someone enrolled it in device management.

Lockdown Mode: the strongest built-in defence

If you may be targeted by mercenary spyware, turn on Lockdown Mode (iPhone, iPad and Mac, iOS 16 and later): Settings ’ Privacy & Security ’ Lockdown Mode. It sharply reduces the attack surface — it blocks many message attachment types, risky web technologies, incoming FaceTime from strangers and wired connections when locked. Apple positions it for the small number of people at serious targeted risk. Apple: Lockdown Mode

Apple also sends Threat Notifications to users it believes were targeted by state‑sponsored attackers, by iMessage and email and on the Apple ID site. If you ever get one, treat it as real and seek expert help. Apple: Threat Notifications

The real check: Amnesty’s MVT

For a genuine forensic answer, Amnesty International’s Mobile Verification Toolkit (MVT) is the standard open‑source tool. MVT (mvt-project) It works on a computer: you make an encrypted backup of the iPhone, point MVT at it, and it checks the backup against indicator‑of‑compromise lists for Pegasus, Predator, RCS Lab and other families, flagging suspicious domains, processes and timeline entries. Amnesty International Security Lab

It is a command‑line tool aimed at technical users and responders, not a one‑tap scanner, and a clean result is not an absolute guarantee. If you are not comfortable with it, a digital‑security clinic or the Access Now Helpline can run or guide the check. There is no reliable App Store “Pegasus scanner” — be wary of apps that claim to be one.

If you find something — or you’re in danger

Account case: change your Apple ID password from a device you trust, turn on two‑factor authentication, remove unknown devices and profiles, and check Find My and Safety Check. Consider a new Apple ID if the account is deeply compromised.

Targeted case: preserve evidence (don’t wipe first if you may report it), turn on Lockdown Mode, and get expert help — the Access Now Helpline, a security clinic, or Citizen Lab. A full reset and OS update removes most non‑persistent mercenary spyware, but change every password afterward from a clean device.

Safety first. If an abuser is monitoring you, acting suddenly — removing a profile, changing a password — can escalate danger. Talk to a domestic‑violence advocate before you change things. Our phone checks cover the Android side.

Sources

Read on 25 October 2026. This is general information, not legal or security advice for your specific situation.

Frequently Asked Questions

Can someone spy on my iPhone without touching it?

Usually only through your Apple ID. If they know your Apple ID and password they can see your iCloud location, photos and backups from a browser, with no app on the phone. Change the password, turn on two-factor authentication, and remove devices you do not recognise. Remote mercenary spyware like Pegasus exists but targets specific high-risk people, not the general public.

Is there an app that scans my iPhone for Pegasus?

Not a reliable one. The real tool is Amnesty International’s Mobile Verification Toolkit, which runs on a computer against an encrypted backup, not a one-tap App Store scanner. Treat apps that claim to detect Pegasus with suspicion. For a trustworthy check, use MVT or a digital-security clinic.

What is Lockdown Mode and should I use it?

Lockdown Mode is a setting on iOS 16 and later that sharply reduces the attack surface by blocking risky message attachments, web features, FaceTime from strangers and wired connections when locked. It is meant for the small number of people at serious targeted risk, such as journalists and activists. Most people do not need it, but it does little harm to try.

Does a factory reset remove iPhone spyware?

It removes most non-persistent spyware, and updating to the latest iOS closes the exploit that got in. But if the problem is account access, a reset alone does nothing: you must change your Apple ID password and remove unknown devices. Always set the phone up fresh and change passwords from a device you trust.

Why is iPhone stalkerware less common than on Android?

Apple’s sandbox stops one app from reading another app’s data or running hidden in the background, so the openly sold monitor-any-phone apps common on Android mostly cannot work on a normal iPhone. On iOS, monitoring usually needs your iCloud login, a configuration profile, device management enrolment, or a jailbreak.

I got an Apple threat notification. What should I do?

Treat it as real. Apple sends these only when it believes a state-sponsored attacker targeted you. Turn on Lockdown Mode, update iOS, and get expert help from a digital-security clinic, Citizen Lab, or the Access Now helpline before wiping anything you might need as evidence.

Next step

Lock down the account first. Change your Apple ID password and turn on two-factor authentication from a device you trust, then work through the five-minute checks above. For Android, use our Phone Stalkerware Check.