MVT Setup: Scan an iPhone Backup for Spyware

MVT, the Mobile Verification Toolkit, is a free command line forensics tool from Amnesty International's Security Lab that scans an iPhone or Android backup for traces of Pegasus, Predator, Candiru and a dozen other commercial spyware families. It added roughly 440 stars in a single day on GitHub trending this week, on top of about 14,000 total, and version 2026.9.21 landed two days ago. Setup takes about fifteen minutes end to end: install it with pipx or pip, pull down the public indicators, decrypt your backup, and run one scan command that ends in a graded alerts table.

• MVT is the tooling from the 2021 Pegasus Project investigation, released publicly by Amnesty International and still maintained today.
• It analyses an offline backup, never a live phone, which is why it needs no jailbreak, no root and no agent installed on the device.
• Detection content is separate from the tool: mvt download-iocs pulls 19 public STIX2 indicator files covering Pegasus, Predator, NoviSpy, Cellebrite and stalkerware families.
• The project is explicit that a clean run does not mean a clean phone. Public indicators lag real campaigns, and MVT is a triage tool, not an antivirus.

The exact steps, start to finish

1. Check your prerequisites. MVT needs Python 3.6 or newer, and pipx is the recommended installer.

   $ python3 --version
   $ pip3 --version
   $ pipx --version
   # Linux only, install the system dependencies first
   $ sudo apt install python3 python3-venv python3-pip sqlite3 libusb-1.0-0

2. Install MVT. One command with pipx, which keeps it isolated from your system Python.

   $ pipx install mvt

3. Confirm the three commands exist. You should now have mvt, mvt-ios and mvt-android on your path. Running mvt on its own prints the version and the available subcommands.

   $ mvt version

4. Download the indicators of compromise. This is the step people skip, and without it MVT extracts your data but has nothing to match it against. It is free and needs no account or API key.

   $ mvt download-iocs

5. Make an encrypted backup of the iPhone. On macOS open Finder, select the device in the sidebar, choose Back up all the data on your iPhone to this Mac, tick Encrypt local backup and set a password. On Windows use iTunes with the same encryption option. Keep that password, you cannot decrypt without it.
6. Extract the decryption key, then decrypt the backup. MVT can only analyse a decrypted copy.

   $ mvt-ios extract-key -k backup.key /path/to/backup/udid
   $ mvt-ios decrypt-backup -k backup.key -d decrypted/ /path/to/backup/udid

7. See which modules will run. Optional, but it tells you exactly which artifacts MVT is about to read.

   $ mvt-ios check-backup --list-modules decrypted/

8. Run the scan. Point --iocs at an indicator file and --output at a results folder. This is the payoff step.

   $ mvt-ios check-backup --iocs ~/iocs/pegasus.stix2 --output results/ decrypted/

9. Read the alerts table and the results folder. The run ends with a count per severity level. Every module writes a JSON file, and anything matching an indicator gets a second file with a _detected suffix.

   $ ls results/
   $ cat results/alerts.json

What is MVT and why is it trending?

Amnesty International's Security Lab built MVT and released it in July 2021 alongside the Pegasus Project, the Forbidden Stories investigation that documented NSO Group's spyware on the phones of journalists, lawyers and activists. The forensic methodology report that accompanied it explained how those traces were found. MVT is that methodology turned into a tool anyone can run, and it has stayed under active maintenance ever since, with releases now tagged by date rather than semantic version. The current build is 2026.9.21.

RelatedOpenCode Setup: Install the Open-Source AI Coding Agent

The recent surge in attention follows the project's merge of its long running v3 branch, which restructured the command line into three binaries and introduced a plugin system. mvt now holds what belongs to neither platform, meaning version, completion, plugins and download-iocs, while mvt-ios and mvt-android handle acquisitions from their respective platforms. Plugin packages can register extra forensic modules that run inside the check-* commands, which opens the door to private or organisation specific detection logic without forking the project.

How do you install MVT on Linux, macOS and Windows?

The documented path on Linux is to install the system dependencies first, then use pipx. On Ubuntu 23.04 or above sudo apt install pipx followed by pipx ensurepath is enough; on 22.04 or below the docs use python3 -m pip install --user pipx instead. The libusb-1.0-0 package is only needed if you intend to use mvt-android.

On macOS, MVT requires Xcode and Homebrew, and the dependency line from the docs is brew install python3 pipx libusb sqlite3. For Android work you also want the platform tools, via brew install --cask android-platform-tools.

Windows is the awkward one. MVT does not currently officially support running natively on Windows, and the docs single out mvt-android as the part most likely to break. The recommended route is Windows Subsystem for Linux, following the Linux instructions for whichever distribution you install. If you would rather not use pipx at all, a plain virtual environment works on every platform:

$ python3 -m venv env
$ source env/bin/activate
$ pip install mvt

How do you get the indicators of compromise?

MVT ships with the extraction logic but not the detection content. Indicators arrive as STIX2 files, a JSON structure describing domains, process names, file paths, hashes, bundle identifiers and configuration profile IDs associated with a known campaign. mvt download-iocs fetches the current public set from Amnesty's investigations repository and from the project's own mvt-indicators repository. A fresh download currently lands 19 files, covering Pegasus, Predator from Cytrox, Wintego Helios, NoviSpy from the Serbia investigation, Candiru, Cellebrite, Operation Triangulation, QuaDream KingsPawn, RCS Lab and a generated stalkerware set.

You can also point at indicator files by hand with --iocs, which accepts the flag multiple times, or set the MVT_STIX2 environment variable to a colon separated list of paths. If you are working somewhere that should not make outbound requests, setting MVT_NETWORK_ACCESS_ALLOWED=false stops MVT resolving shortened URLs during the check.

How do you run the scan and read the results?

The scan itself is a single command. MVT walks each module in turn, prints where it found the underlying database, says how many records it extracted, and flags matches as it goes. A run against a small backup finishes in seconds; a full device backup takes longer, and --fast skips the time consuming checks if you need a first pass quickly.

RelatedHermes Agent Setup: A Free, Self-Improving AI CLI

What matters is the end of the output. MVT prints a summary counting alerts at five levels, from informational through low, medium and high to critical, followed by a standing note that the lack of severe alerts does not equate to a clean bill of health. Informational alerts are often useful context rather than warnings; a run that reports lockdown mode enabled is telling you the device already has Apple's hardened mode switched on. The results folder holds one JSON file per module, a combined alerts.json, and two CSV timelines that are genuinely useful if you want to line events up against a date you already suspect.

What are the gotchas before you rely on it?

Four things, and the first is the one the project itself leads with. Public indicators are insufficient to determine that a device is clean. Serious operators rotate infrastructure quickly, and by the time a domain appears in a published STIX2 file it has often been retired. Amnesty's own guidance is that comprehensive triage needs non public indicators and threat intelligence, which is why the tool points at the Security Lab and Access Now's Digital Security Helpline for people who genuinely believe they are targeted.

Second, the v3 merge introduced breaking changes to output. If you had scripts parsing older MVT JSON, expect them to need work; the project tracks this in issue 757. Third, an unencrypted iTunes backup contains substantially less of what MVT wants to read, so encrypting the backup is effectively a requirement rather than a nice to have. Fourth, and this is a licensing matter rather than a technical one, MVT is released under its own license built specifically around consensual forensic analysis. Running it against a device you do not own or have clear permission to examine falls outside what that license permits.

Our take

MVT is the rare security tool that is genuinely free, genuinely maintained, and genuinely used in real investigations rather than positioned as an enterprise sales funnel. That combination is why it keeps resurfacing on trending five years after release. It is also not a consumer product, and the maintainers are refreshingly blunt about that. If you are a journalist, a researcher, or someone who works with people at risk, learning to run this is worth an afternoon. If you are simply curious whether your own phone is compromised, the honest answer is that a clean MVT run proves very little, and turning on Lockdown Mode is a better use of ten minutes. The real value here is that a documented forensic path exists at all, which for most of the world's at risk users was not true before 2021.

Original analysis by GenZTech. Tool documentation: mvt-project/mvt on GitHub.