Mobile Verification Toolkit (MVT) is a tool to facilitate the consensual forensic analysis of Android and iOS devices, for the purpose of identifying traces of compromise. The Mobile Verification Toolkit (MVT) was developed by the Amnesty International Security Lab.
Here are common known spyware can be trace by MVT:
- Pegasus: NSO Group spyware targeting iOS and Android
- Predator: Commercial spyware associated with Intellexa
- Reign: Sophisticated spyware associated with QuaDream
- Hermit: Commercial spyware associated with RCS Lab
- KingsPawn: Spyware associated with QuaDream investigations
- FinSpy / FinFisher: Commercial surveillance software
- DarkCaracal: Mobile surveillance campaign targeting Android devices
Install python
# apt install python3 python3-venv sqlite3 libusb-1.0-0 libimobiledevice-utils usbmuxd pipx
Install adb for android
# apt install -y android-sdk-platform-tools android-sdk-platform-tools-common
Create virtual python
$ pipx ensurepath
Success! Added /[home_user]/.local/bin to the PATH environment variable.
Consider adding shell completions for pipx. Run 'pipx completions' for
instructions.
You will need to open a new terminal or re-login for the PATH changes to take
effect. Alternatively, you can source your shell's config file with e.g.
'source ~/.bashrc'.
Otherwise pipx is ready to go!
Install mvt
$ pipx install mvt
installed package mvt 2026.11.2, installed using Python 3.13.5
These apps are now globally available
- mvt
- mvt-android
- mvt-ios
⚠️ Note: '/[home_user]/.local/bin' is not on your PATH environment
variable. These apps will not be globally accessible until your PATH is
updated. Run `pipx ensurepath` to automatically add it, or manually modify
your PATH in your shell's config file (e.g. ~/.bashrc).
done!
$ ls ./.local/bin/
mvt mvt-android mvt-iosAdd virtual python binary
$ echo 'export PATH="$HOME/.local/bin:$PATH"' >> ~/.bashrc
$ source ~/.bashrc
$ mvt version
MVT - Mobile Verification Toolkit
https://mvt.re
Version: 2026.11.2
You have not yet downloaded any indicators, check the `download-iocs`
command!Download spyware indicators
$ mvt download-iocs
MVT - Mobile Verification Toolkit
https://mvt.re
Version: 2026.11.2
You have not yet downloaded any indicators, check the `download-iocs`
command!
[mvt.common.updates] Downloaded indicators "NSO Group Pegasus
Indicators of Compromise" to
/[home_user]/.local/share/mvt/indicators/raw.githubusercontent.com_AmnestyTec
h_investigations_master_2021-07-18_nso_pegasus.stix2
[mvt.common.updates] Downloaded indicators "Predator Spyware
Indicators of Compromise" to
/[home_user]/.local/share/mvt/indicators/raw.githubusercontent.com_mvt-projec
t_mvt-indicators_main_intellexa_predator_predator.stix2
[mvt.common.updates] Downloaded indicators "RCS Lab Spyware
Indicators of Compromise" to
/[home_user]/.local/share/mvt/indicators/raw.githubusercontent.com_mvt-projec
t_mvt-indicators_main_2022-06-23_rcs_lab_rcs.stix2
[mvt.common.updates] Downloaded indicators "Stalkerware
Indicators of Compromise" to
/[home_user]/.local/share/mvt/indicators/raw.githubusercontent.com_AssoEchap_
stalkerware-indicators_master_generated_stalkerware.stix2
[mvt.common.updates] Downloaded indicators "Surveillance campaign
linked to mercenary spyware company" to
/[home_user]/.local/share/mvt/indicators/raw.githubusercontent.com_AmnestyTec
h_investigations_master_2023-03-29_android_campaign_malware.stix2
[mvt.common.updates] Downloaded indicators "Quadream KingSpawn
Indicators of Compromise" to
/[home_user]/.local/share/mvt/indicators/raw.githubusercontent.com_mvt-projec
t_mvt-indicators_main_2023-04-11_quadream_kingspawn.stix2
[mvt.common.updates] Downloaded indicators "Operation
Triangulation Indicators of Compromise" to
/[home_user]/.local/share/mvt/indicators/raw.githubusercontent.com_mvt-projec
t_mvt-indicators_main_2023-06_01_operation_triangulation_operation_triangulation
.stix2
[mvt.common.updates] Downloaded indicators "WyrmSpy and DragonEgg
Indicators of Compromise" to
/[home_user]/.local/share/mvt/indicators/raw.githubusercontent.com_mvt-projec
t_mvt-indicators_main_2023-07-25_wyrmspy_dragonegg_wyrmspy_dragonegg.stix2
[mvt.common.updates] Downloaded indicators "Wintego Helios
Indicators of Compromise" to
/[home_user]/.local/share/mvt/indicators/raw.githubusercontent.com_AmnestyTec
h_investigations_master_2024-05-02_wintego_helios_wintego_helios.stix2
[mvt.common.updates] Downloaded indicators "NoviSpy (Serbia)
Indicators of Compromise" to
/[home_user]/.local/share/mvt/indicators/raw.githubusercontent.com_AmnestyTec
h_investigations_master_2024-12-16_serbia_novispy_novispy.stix2
[mvt.common.updates] Downloaded indicators "EagleMsgSpy
Indicators of Compromise" to
/[home_user]/.local/share/mvt/indicators/raw.githubusercontent.com_mvt-projec
t_mvt-indicators_main_2024-12-25_eaglemsgspy_eaglemsgspy.stix2
[mvt.common.updates] Downloaded indicators "Candiru
(DevilsTongue) Indicators of Compromise" to
/[home_user]/.local/share/mvt/indicators/raw.githubusercontent.com_mvt-projec
t_mvt-indicators_main_candiru_candiru.stix2
[mvt.common.updates] Downloaded indicators "ResidentBat
Indicators of Compromise" to
/[home_user]/.local/share/mvt/indicators/raw.githubusercontent.com_mvt-projec
t_mvt-indicators_main_ResidentBat_residentbat.stix2
[mvt.common.updates] Downloaded indicators "Cellebrite Indicators
of Compromise" to
/[home_user]/.local/share/mvt/indicators/raw.githubusercontent.com_mvt-projec
t_mvt-indicators_main_cellebrite_cellebrite.stix2
[mvt.common.updates] Downloaded indicators "DarkSword Indicators
of Compromise" to
/[home_user]/.local/share/mvt/indicators/raw.githubusercontent.com_mvt-projec
t_mvt-indicators_main_2026-03-30_darksword_darksword.stix2
[mvt.common.updates] Downloaded indicators "Coruna Indicators of
Compromise" to
/[home_user]/.local/share/mvt/indicators/raw.githubusercontent.com_mvt-projec
t_mvt-indicators_main_2026-03-03_coruna_cryptowaters_coruna.stix2
[mvt.common.updates] Downloaded indicators "Morpheus Indicators
of Compromise" to
/[home_user]/.local/share/mvt/indicators/raw.githubusercontent.com_mvt-projec
t_mvt-indicators_main_2026-04-23_ips_morpheus_morpheus.stix2
[mvt.common.updates] Downloaded indicators "BTMOB Indicators of
Compromise" to
/[home_user]/.local/share/mvt/indicators/raw.githubusercontent.com_mvt-projec
t_mvt-indicators_main_2026-05-26_btmob_btmob.stix2
[mvt.common.updates] Downloaded indicators "Spyrtacus Indicators
of Compromise" to
/[home_user]/.local/share/mvt/indicators/raw.githubusercontent.com_mvt-projec
t_mvt-indicators_main_2026-04-09_sio_spyrtacus_spyrtacus.stix2
$ mvt version
MVT - Mobile Verification Toolkit
https://mvt.re
Version: 2026.11.2
Indicators updates checked recently, next automatic check in 12 hoursMVT installation done.
NOTE: steps below does not tested, and may different output depends on your android phone.
You MUST enable developer option and debug on your Android phone. Connect your android phone using usb cable.
create directory for forensic
$ mkdir -p ~/forensics/{evidence/android,working/android,reports/android}
Pull your data from android phone
$ adb bugreport ~/forensics/evidence/android/bugreport.zip
Scan your data to find evidence of spying malware
$ mvt-android check-bugreport -o ~/forensics/reports/android/ ~/forensics/evidence/android/bugreport.zip
Find out the result on folder ~/forensics/reports/android/
