Mobile Verification Toolkit (MVT): How Defenders Check Phones for Spyware Traces

When a journalist, executive or activist receives a spyware warning, the first question is whether their phone shows traces of compromise, and the most widely used free tool for answering it is often misunderstood. The Mobile Verification Toolkit (MVT) is a command-line forensic tool from Amnesty International's Security Lab that parses iOS and Android acquisitions and compares them against indicators of known spyware campaigns. This guide explains what MVT does and does not do, how security and incident response teams should run it safely and lawfully, how to read its results, and what to use alongside it. It is written for incident responders, digital forensics analysts and security teams supporting high-risk staff. It does not repeat the response steps in the Mobile Spyware Infection Response Playbook; it goes deeper on the tool itself. Facts reflect the MVT repository and documentation as checked on 8 November 2026 (release tag v2026.11.2).

This is an independent guide from NHI Mgmt Group, based on Amnesty International Security Lab's public documentation as of November 2026. It is not sponsored or reviewed by Amnesty International Security Lab. Product features change, so confirm settings against Amnesty International Security Lab's current documentation.

Key takeaways

• MVT finds known traces, it does not certify a phone clean. Its own documentation warns that public indicators of compromise are insufficient to determine that a device was not targeted, and can give a false sense of security.
• Consent is a licence condition, not a courtesy. MVT ships under an adapted Mozilla Public License with a "Consensual Use Restriction": the data owner must give explicit, informed consent free from coercion, including about retention and disposal.
• Acquisition quality decides the result. An encrypted iOS backup yields records an unencrypted one does not, and on Android, MVT now analyses AndroidQF collections rather than talking to a live phone over ADB.
• Indicators go stale quickly. Run download-iocs before every analysis and re-check stored acquisitions when new indicator sets are published.
• Plan for escalation. MVT is a triage and research tool; a positive or ambiguous finding should go to specialists such as Amnesty's Security Lab or the Access Now Digital Security Helpline, which hold non-public indicators.

What the tool does

MVT was released in July 2021 alongside the Pegasus Project and Amnesty's forensic methodology report on NSO Group's Pegasus, and continues to be maintained by Amnesty International and other contributors. It is a Python package (Python 3.11 or newer) that installs three commands: mvt-ios and mvt-android analyse acquisitions from each platform, and mvt hosts shared functions such as version, download-iocs, plugins and completion. A 2026 "v3" merge introduced breaking changes to output, so scripts that parse MVT results need retesting after upgrades.

MVT does four things: it decrypts encrypted iOS backups, parses records from system and app databases, logs and analytics, compares those records with indicators in STIX2 format, and writes JSON results plus a unified chronological timeline. Matches are written to separate files with a _detected suffix, so an analyst can review hits without wading through every record.

What MVT analyses on each platform

Direct Android analysis over ADB has been removed: the maintainers found it produced inconsistent and incomplete collections across devices. The companion AndroidQF tool, a standalone Go binary, now performs collection, and MVT performs analysis. Android Intrusion Logging, released for Android 16 in May 2026 and initially on Pixel devices according to Amnesty's announcement, records process starts, DNS queries, outbound connections, ADB activity and unlock events. Logs are encrypted with a key protected by the device PIN before being stored in the user's Google account. See the Android Advanced Protection guide for how users enable it.

How indicator matching works

MVT implements a subset of STIX 2: each indicator is a single comparison, not a boolean expression. Supported types are domain-name:value, url:value, process:name, email-addr:value, file:name, file:path, file MD5, SHA-1 and SHA-256 hashes, app:id, configuration-profile:id and android-property:name. Each module checks only the types relevant to its data. Indicators can be passed with repeated --iocs options, through the MVT_STIX2 environment variable, or downloaded automatically from the mvt-indicators repository, which collects public sets from Amnesty and other researchers covering campaigns such as Pegasus and Predator, plus a stalkerware set. See the STIX and TAXII Guide for the format.

Defender use cases

• Triage after a threat notification: Apple sends threat notifications to users it believes were individually targeted by mercenary spyware, through a lock screen alert, email and a banner at account.apple.com, and says it has notified users in over 150 countries since 2021. An MVT check of a fresh encrypted backup is a common first step, alongside Apple's own advice to enable Lockdown Mode and contact the Access Now helpline. See the Apple Lockdown Mode Guide.
• Protective checks for high-risk staff: security teams supporting executives, journalists, lawyers or negotiators can offer periodic consensual checks, especially after travel. See the Mobile Communications Protection for High-Risk Individuals Guide.
• Retrospective hunting: keep MVT output (with consent and a retention limit) and re-run check-iocs when researchers publish new indicators. This is how many historic infections were found: the indicator arrived after the attack.
• Smishing and link investigation: MVT extracts URLs from SMS and messaging records and, when network access is allowed, expands known URL shorteners to compare the destination with domain indicators.
• Stalkerware checks on Android: with the public stalkerware indicator set, MVT can flag known monitoring apps by package name. Handle these cases with safety planning, because removing stalkerware can alert an abuser. See the Spyware and Stalkerware Guide.
• Training and research: forensic teams use MVT and its plugin interface to build modules for new data sources, such as sysdiagnose archives.

Deployment and safe use

MVT handles some of the most sensitive data a person owns: messages, call history, contacts, browsing and location-related records. Treat every run as a forensic engagement with an evidence trail, not as a quick scan.

Rollout for a security or IR team

1. Set the legal and consent basis first. Write a consent form that states what will be acquired, who will see it, how long it is kept and how it is destroyed, matching the licence's clause 3.0. Corporate ownership of a phone does not replace the individual's consent under the MVT licence, and personal data processing needs its own lawful basis (NIST SP 800-53 PT-2 covers authority to process). Never use MVT on a device whose user has not agreed.
2. Build an isolated analysis workstation. Use a dedicated Linux or macOS machine with full-disk encryption. MVT does not officially support native Windows; the docs suggest WSL. The prebuilt Docker image (ghcr.io/mvt-project/mvt) simplifies dependencies but USB passthrough needs a Linux host. Install with pipx or a virtual environment, and pin the version you validated.
3. Control network behaviour. By default MVT sends HTTP HEAD requests to expand shortened URLs found in records, up to 20 at a time. Set MVT_NETWORK_ACCESS_ALLOWED=false when contacting attacker infrastructure could tip off an operator or breach your handling rules. The AndroidQF --virustotal option sends APK hashes to a third party; leave it off unless the case allows it.
4. Acquire carefully. For iOS, create an encrypted local backup with a strong one-time password and keep the phone unlocked during backup. For Android, run AndroidQF and accept the intrusion log prompt where available. Avoid jailbreaking for a filesystem dump unless all other options are exhausted and the device will not be returned to service.
5. Preserve and hash. Hash the acquisition before analysis, store it read-only, and record who handled it (NIST SP 800-101 Rev. 1 and AU-9 principles). The backup decryption key from extract-key is sensitive: store it with the evidence, not in shell history or the analyst's home folder. Prefer prompts over passing passwords on the command line.
6. Update indicators and run. Run mvt download-iocs, then the relevant check command with an output folder. Record the MVT version and indicator set date in the case notes so results can be reproduced.
7. Review, escalate, dispose. Review _detected files and the timeline, escalate positives, then delete or return data on the agreed schedule and record the disposal.

Reading results

Common failure patterns

• Calling a device clean: reporting "no spyware" from a public-indicator scan, which the MVT maintainers explicitly warn against.
• Unencrypted backups: analysing an unencrypted iOS backup and missing records that only an encrypted backup contains.
• Stale indicators: running with an old local indicator set and never re-checking stored output.
• Wiping before acquisition: factory resetting or updating the phone first, destroying the evidence a lab would need.
• Leaky analyst hosts: leaving decrypted backups and keys on a shared laptop or cloud-synced folder, creating a second privacy incident.
• Self-service misuse: handing MVT to non-specialists; the documentation states it is not for end-user self-assessment.

Detection and hardening value

MVT is a detection aid that works after the fact. Its value grows when it sits inside a programme that also reduces exposure and increases telemetry before an incident.

• Turn on telemetry before you need it: Android Intrusion Logging cannot be collected retroactively, so high-risk users should enable Advanced Protection and Intrusion Logging in advance.
• Reduce attack surface: Lockdown Mode on iOS and Advanced Protection on Android shrink the exploit surface that mercenary spyware relies on. See the Commercial Spyware Guide.
• Feed intelligence back: confirmed findings, shared through a trusted lab, become the indicators that protect others.

Metrics that show the programme works: time from threat notification to completed acquisition; percentage of checks run with indicators less than 7 days old; percentage of high-risk users with Lockdown Mode or Advanced Protection and Intrusion Logging enabled; number of stored acquisitions re-checked after each new indicator release; and percentage of cases with a documented consent form and disposal record (target 100%).

Alternatives

MVT is rarely the only tool in a mobile investigation. Choose based on the question, the evidence available and who is doing the work.

For a full investigation workflow across tools, see the Mobile Forensics Guide; for general indicator scanners on desktops and servers, see the IOC Scanners Guide.

Practitioner checklist

• Use a written consent form that covers scope, access, retention and disposal, in line with the MVT licence's Consensual Use Restriction.
• Maintain a dedicated, encrypted analysis host with a pinned, tested MVT version and retest parsers after major upgrades.
• Decide per case whether MVT may make network requests, and set MVT_NETWORK_ACCESS_ALLOWED accordingly.
• Acquire iOS data as an encrypted backup and Android data with AndroidQF, including intrusion logs where enabled.
• Hash and store acquisitions read-only, and protect backup passwords and decryption keys as evidence.
• Run download-iocs before each analysis and log the MVT and indicator versions in the case record.
• Report results as "no known indicators found as of [date]" rather than "clean", and escalate positives to a specialist lab.
• Re-run check-iocs on retained output when new indicator sets are published, within the agreed retention period.
• Encourage high-risk users to enable Lockdown Mode or Android Advanced Protection with Intrusion Logging before an incident.

Standards and references

• MVT Project: Mobile Verification Toolkit documentation
• MVT Project: Mobile Verification Toolkit source repository and licence
• MVT Project: AndroidQF
• Amnesty International Security Lab: Android Intrusion Logging as a new source of data for consensual forensic analysis
• Apple: About Apple threat notifications and protecting against mercenary spyware
• NIST: SP 800-101 Rev. 1, Guidelines on Mobile Device Forensics
• NIST: SP 800-53 Rev. 5
• MITRE ATT&CK: Phishing (Mobile)

Related NHI Mgmt Group resources: Mobile Spyware Infection Response Playbook · Mobile Forensics Guide · Commercial Spyware Guide · Apple Lockdown Mode Guide · Android Advanced Protection