Spyware on iPhone: How to Detect It (and What to Do)

Once you’ve installed and opened iMazing, plug your iPhone into the computer with a cable. At first you’ll see Please Connect an Apple Device; once it’s plugged in, iMazing switches to Pairing in progress and asks you to unlock the iPhone and trust the computer. If your iPhone is locked, unlock it so it can start pairing.

The rest happens on the iPhone. It asks Trust This Computer? — tap Trust, then enter your passcode to confirm. This grants the computer permission to read the device, which is exactly what the scan needs.

Not asked to trust? That usually means you’ve paired this iPhone with the computer before — you can skip this and go straight to seeing your phone listed, as in the next step.

Once pairing succeeds, your iPhone appears under Devices. Click it to open its Overview — the home base for everything iMazing can do with your phone, including the spyware scan.

With your iPhone selected, click Tools, then Detect Spyware. iMazing opens the About Spyware Detection intro — a quick rundown of what the scan does (local analysis on your own computer, based on Amnesty International’s Security Lab). Read it, then click Next.

On the intro screen, click Next to reach the scan settings. iMazing asks where to get its indicators of compromise and how to save the report — the defaults are fine, so just click Next again to move on to the backup step.

This is the one setting worth changing. Toggle Enable backup encryption on, set a backup password (keep a safe copy — it can’t be recovered), and authorise it on your iPhone with your passcode or Face ID. An encrypted backup captures far more of your device, so the scan can check many more places spyware hides.

For this scan the password doesn’t need to be complex — something as simple as 1234 is more than enough. Just know that any future backups you make with iMazing or other software will use this same password to decrypt. If you’re concerned about a backup being stolen and decrypted to access your personal information, it’s better to set a strong password now.

You can optionally let iMazing remember your encryption password to make the analysis more convenient. If you’d rather keep it to yourself, that’s fine — you’ll just be asked to enter it during the decryption stage of the scan.

Detect Spyware is consensual-use only: only scan a device you own, or one you have the owner’s explicit permission to check. Tick the licence and limitations boxes, then click Next.

As the scan begins, iMazing asks you to enter your passcode on the iPhone one more time to authorise it — this kicks off the actual backup. It then backs up your iPhone, decrypts the files it needs, and analyses them against known indicators, all on your computer with nothing uploaded. On a full phone the backup can take a while, so you can leave it running.

As the backup finishes, iMazing decrypts the data it needs and begins the analysis. If you didn’t tick Remember Password earlier, it asks for your backup encryption password here — enter it and click OK to let the analysis run. (That’s the password you set in step 6, or an existing one if encryption was already on.)

A clean result — “No signs of infection detected” — means no known spyware was found. That’s reassuring; carry on to the checks below for the other ways someone can watch you.

If it flags something, don’t remove anything yourself (see the warning just below). Open the report and save it — a digital-forensics professional will need it to confirm the findings and advise you on what to do next.