How To Detect If Government Malware Is Installed On Your

Last updated: March 16, 2026

Government-sponsored malware represents a sophisticated category of threats designed to surveil journalists, activists, dissidents, and security researchers. Unlike commodity malware that seeks financial gain, state-sponsored tools like NSO Group’s Pegasus, Cytrox’s Predator, and various Android-based surveillance platforms aim to extract communications, location data, and device content with precision. This guide provides developers and power users with practical detection techniques using command-line tools, forensic analysis, and behavioral monitoring.

Table of Contents

Prerequisites
Advanced Forensic Analysis
When to Seek Professional Help
Troubleshooting
Related Reading

Prerequisites

Before you begin, make sure you have the following ready:

A computer running macOS, Linux, or Windows
Terminal or command-line access
Administrator or sudo privileges (for system-level changes)
A stable internet connection for downloading tools

Step 1 - Understand the Threat Field

State-sponsored mobile malware differs fundamentally from typical threats. These tools often exploit zero-day vulnerabilities, use certificate abuse, and use sophisticated evasion techniques. Pegasus, for instance, exploited FORCEDENTRY and other iOS vulnerabilities to achieve zero-click infection via iMessage. Android variants like Predator used Chrome zero-days and chainable exploits to achieve persistence.

The sophistication level means traditional antivirus solutions frequently fail to detect these threats. Detection requires a defense-in-depth approach combining system analysis, network forensics, and behavioral monitoring.

Step 2 - iOS Detection Techniques

Checking for Suspicious Profiles

iOS configuration profiles can provide persistence for MDM-based surveillance tools. Query installed profiles:

List all installed configuration profiles
profiles status -type configuration

If you find unknown profiles, remove them:

Remove a specific profile (requires profile identifier)
sudo profiles remove -identifier com.example.suspicious

Analyzing Installed Apps

Review your installed applications for suspicious entries. Government malware often uses generic names or impersonates system applications:

iOS: List all third-party apps via Xcode (requires developer tools)
xcrun simctl list devices available | grep -i "app name"

Or export IPA and analyze
mkdir app_analysis && cd app_analysis
unzip -q ../suspected.ipa
ls Payload/*.app/

Checking Running Processes

On jailbroken devices, inspect running processes:

List all processes
ps -aux

Look for suspicious binaries
ls -la /Applications/ | grep -vE "^(Apple|System)"

Step 3 - Android Detection Techniques

Using ADB for Deep Inspection

Android Debug Bridge provides powerful diagnostic capabilities:

List all installed packages
adb shell pm list packages

Find packages installed at suspicious times
adb shell pm list packages -3 | while read pkg; do
    echo "$pkg: $(adb shell dumpsys package $pkg | grep -i 'firstInstallTime')"
done

Check for hidden apps (app ops)
adb shell appops list

Examining System Permissions

Government malware requires extensive permissions. Audit permission grants:

Check dangerous permissions across all apps
adb shell dumpsys package | grep -A 5 "android.permission."

Specific checks for known surveillance permissions
adb shell pm list permissions -d -g | grep -E "(CAMERA|RECORD_AUDIO|READ_CONTACTS|READ_SMS|ACCESS_FINE_LOCATION|READ_CALL_LOG)"

Analyzing Running Services

Detect malicious services running in the background:

List all running services
adb shell dumpsys activity services

Monitor for new services
adb shell dumpsys activity services > baseline.txt
Wait period, then compare
adb shell dumpsys activity services > current.txt
diff baseline.txt current.txt

Step 4 - Network-Based Detection

Monitoring DNS Queries and Traffic

Government malware communicates with command-and-control (C2) servers. Network analysis can reveal these connections:

On Android (requires root or adb)
adb shell tcpdump -i any -w /sdcard/capture.pcap
Analyze with Wireshark
wireshark /sdcard/capture.pcap

Look for suspicious domains
adb shell "getprop net.dns1" && getprop | grep dns

Using Suricata for IDS

Deploy an Intrusion Detection System on a network level:

suricata.yaml - detect known C2 signatures
alert dns $HOME_NET any -> any any (dns.query; content:"suspicious-domain.com"; sid:1000001;)
alert tls $HOME_NET any -> any any (tls.subject; content:"malicious-cert.com"; sid:1000002;)

Step 5 - Behavioral Indicators

Battery Anomalies

Government malware runs background services that drain battery disproportionately:

Android - Check battery stats
adb shell dumpsys batterystats > battery.txt
Analyze with battery historian (Google tool)
python battery_historian.py battery.txt

Look for:

Unexplained high battery usage by system server or unknown apps
Wakelock patterns indicating persistent background activity

Network Traffic Patterns

Monitor for data exfiltration:

Monitor network connections in real-time
adb shell ss -tulwp

Check for unusual connections
adb shell netstat -an | grep -E "(ESTABLISHED|LISTEN)" | grep -v "127.0.0.1"

Log Analysis

Examine system logs for exploitation indicators:

Android - View main log buffer
adb logcat -d -b main > main_log.txt

iOS: Use idevicesyslog (requires libimobiledevice)
idevicesyslog > ios_log.txt

Search for exploitation indicators
grep -iE "(exploit|vulnerability|overflow|jailbreak|root|sudo)" ios_log.txt

Advanced Forensic Analysis

Memory Forensics

For compromised devices, memory analysis can reveal active malware:

Android memory dump (requires root)
adb shell su -c "dd if=/dev/mem of=/sdcard/memdump.raw"

iOS: Use oslog to export system logs
os_log --style syslog > system_logs.log

APK Analysis

Analyze suspicious APK files:

Decompile APK
apktool d suspicious.apk -o analysis/

Extract and examine DEX files
unzip -q suspicious.apk classes.dex
strings classes.dex | grep -E "(http|https):" | sort -u

Scan for known malicious patterns
jadx -d output/ suspicious.apk

Certificate Analysis

Many government malware tools abuse certificates:

Check APK signing certificates
keytool -printcert -jarfile suspicious.apk

iOS: List installed certificates
trustd -c

Step 6 - Recommended Defense Strategy

For developers and power users at elevated risk:

Keep devices updated - Government malware often exploits known vulnerabilities with available patches
Minimize attack surface - Disable iMessage, RCS, and other messaging features on iOS when not needed
Use encrypted communication - Signal, Session, or similar E2E encrypted messaging reduces surveillance value
Implement network-level monitoring - Deploy Pi-hole with query logging to detect DNS-level C2 communication
Regular audits - Schedule monthly checks of installed apps, profiles, and system behavior

When to Seek Professional Help

If you have strong indicators of compromise:

Contact security researchers at organizations like Amnesty International’s Security Lab or Citizen Lab
Document your findings before wiping devices
Consider whether device seizure by authorities is a realistic threat vector requiring additional physical security measures

Troubleshooting

Configuration changes not taking effect

Restart the relevant service or application after making changes. Some settings require a full system reboot. Verify the configuration file path is correct and the syntax is valid.

Permission denied errors

Run the command with sudo for system-level operations, or check that your user account has the necessary permissions. On macOS, you may need to grant terminal access in System Settings > Privacy & Security.

Connection or network-related failures

Check your internet connection and firewall settings. If using a VPN, try disconnecting temporarily to isolate the issue. Verify that the target server or service is accessible from your network.

Consider whether device seizure by authorities is a realistic threat vector requiring additional physical security measures