When public-interest journalists, legal counsel, or civil activists suspect their smartphones have been compromised, they are frequently misdirected by consumer folklore. Popular internet rumors claim that dialing USSD codes like *#21# or listening for “clicking sounds during calls” proves wiretapping. In reality, modern cellular interception operates entirely silently through digital baseband manipulation, SS7 signaling exploitation, and zero-click mobile exploit chains such as NSO Group’s Pegasus or Cytrox’s Predator.

Detecting whether a modern iOS or Android device is actively monitored requires forensic evidence triage: analyzing background battery discharge curves, extracting device crash logs, inspecting cellular radio handoffs for rogue base stations (IMSI-catchers), and parsing filesystem artifacts using open-source forensic toolkits.

┌────────────────────────────────────────────────────────────────────────┐
│             MOBILE THREAT TAXONOMY & INTERCEPTION VECTORS              │
├────────────────────┬────────────────────┬──────────────────────────────┤
│ ATTACK VECTOR      │ EXPLOIT MECHANISM  │ VISIBLE ARTIFACTS            │
├────────────────────┼────────────────────┼──────────────────────────────┤
│ 1. Zero-Click Spyware│ Memory corruption  │ WebKit/iMessage crash logs,  │
│    (Pegasus/Predator) │ (FORCEDENTRY, etc) │ persistent anomalous daemon  │
├────────────────────┼────────────────────┼──────────────────────────────┤
│ 2. IMSI-Catcher     │ 2G/GSM downgrade   │ Unencrypted BTS broadcast,   │
│    (StingRay/Hailstorm)│ Forced radio attach│ Sudden signal drop to Edge/2G│
├────────────────────┼────────────────────┼──────────────────────────────┤
│ 3. Commercial Stalker│ Sideloaded APK or  │ Accessibility abuse, rogue MDM│
│    Apps (mSpy/Flexi) │ iCloud sync abuse  │ profile, high battery drain  │
├────────────────────┼────────────────────┼──────────────────────────────┤
│ 4. SS7 / Diameter   │ Core telco routing │ Zero device artifacts;      │
│    Network Attacks   │ Location & SMS reroute│ Intercepts SMS 2FA codes   │
└────────────────────┴────────────────────┴──────────────────────────────┘

1. Debunking the USSD Code Myth (*#21#, *#62#)

A persistent myth across social media claims that dialing MMI/USSD codes such as *#21# or *#62# reveals whether government agencies or hackers are wiretapping your device.

DIALED STRING:  *#21#
RESPONSE:       "Voice Call Forwarding: Not Forwarded"
                "Data Call Forwarding: Not Forwarded"

The Technical Reality: These GSM feature codes query your carrier’s standard conditional call-forwarding settings. If your voice calls are forwarded to your voicemail provider’s number (e.g., when your line is busy or outside coverage), the screen displays a phone number. This is ordinary carrier voicemail routing, not a tap.

Government lawful intercept (CAPI/ETSI standards) occurs directly at the telephone exchange or mobile core network (PGW/SGW). It executes inside the telecommunications service provider’s infrastructure without modifying your local phone’s call-forwarding tables.

2. Hard Indicators of Compromise (IoCs)

To determine if malicious implants are running locally on your device, monitor for verifiable telemetry anomalies:

A. Abnormal Ambient Thermal Output & Battery Drain

Malicious spyware operating on mobile OS must maintain persistence, harvest data (microphone buffers, ambient room audio, location history, WhatsApp SQLite databases), and exfiltrate payloads to Command-and-Control (C2) domains. - If your device is noticeably warm while sitting idle on a nightstand with all foreground applications closed, background processes are consuming CPU cycles. - On iOS, navigate to Settings > Battery and inspect the 24-hour battery utilization. If system daemons or deleted applications account for more than 15% of battery drain without corresponding screen time, investigate immediately.

B. Cellular Radio Downgrade Attacks (IMSI-Catchers)

Rogue Cell-Site Simulators (commonly called StingRays) operate by transmitting higher power beacons than surrounding legitimate cell towers, forcing nearby mobile devices to disconnect from LTE/5G and attach to the rogue tower. - Forced 2G Downgrade: Because 2G (GSM) authentication is one-way (the handset proves identity to the tower, but the tower never cryptographically authenticates itself to the handset), StingRays force connections onto 2G where A5/1 or A5/2 encryption can be broken or disabled completely. - If your phone abruptly shifts from full 5G/LTE reception to 2G / EDGE / E / GPRS while in a central urban zone or government district, an active radio interception device may be operating in your immediate vicinity.

[Target Mobile Handset]
        │
        ├── 1. Broadcasts higher transmit power beacon ──────► [Rogue BTS / IMSI-Catcher]
        ├── 2. Forces radio disconnect from legitimate 5G tower ──┘
        ├── 3. Demands unencrypted 2G (GSM) attach request
        └── 4. Reads IMSI, IMEI, and captures unencrypted voice/SMS traffic

3. Forensic Triage on iOS: Sysdiagnose & MVT

The gold standard for validating whether an iPhone has been targeted by state-sponsored zero-click spyware is the Mobile Verification Toolkit (MVT), developed by Amnesty International Security Lab.

Running Mobile Verification Toolkit (MVT) on iOS

# 1. Install MVT via Python Package Index
pip3 install mvt

# 2. Generate an unencrypted local iPhone backup using libimobiledevice
idevicebackup2 backup --full ~/ios_backup/

# 3. Download the latest Citizen Lab & Amnesty STIX Indicators of Compromise (IoCs)
git clone https://github.com/AmnestyTech/investigations.git ~/mvt_iocs/

# 4. Execute forensic database scan against SMS, Safari history, and WhatsApp databases
mvt-ios check-backup --iocs ~/mvt_iocs/ ~/ios_backup/[DEVICE_UUID]/

MVT parses SQLite records across: - DataUsage.sqlite (monitors binary processes making outbound socket connections). - Safari.db (detects known exploit redirect domains). - SMS.db (flags invisible binary SMS containing WAP-push trigger vectors).

4. Forensic Triage on Android: Logcat & Network Dumps

On Android devices, commercial stalkerware often disguises itself under generic system package names like com.network.engine, Device Health Services, or System Update.

Auditing Installed Packages via Android Debug Bridge (ADB)

# Connect device via USB with USB Debugging enabled in Developer Options
adb devices

# List all third-party installed packages with associated installer provenance
adb shell pm list packages -3 -i

# Inspect applications granted Device Administrator privileges (wiping, lock-screen bypass)
adb shell dpm list-active-admins

# Check for applications granted accessibility service permissions
adb shell settings get secure enabled_accessibility_services

[!WARNING] If any application other than legitimate screen readers (e.g., TalkBack) or password autofill managers is listed under enabled_accessibility_services, it has full programmatic access to read all screen text, capture passwords, and log encrypted Signal/WhatsApp chat windows in real-time.

5. Mobile Hardware Comparison: Vulnerability Profiles

6. Immediate Remediation Protocol

If diagnostic indicators suggest your device has been compromised:

1. Physical Air-Gap Isolation: Immediately power down the device and place it into a multi-layer radio-frequency shielding Faraday bag or metal enclosure. Merely toggling “Airplane Mode” does not prevent malicious malware from continuing to record ambient room audio and caching GPS coordinates for later exfiltration.
2. Do Not Restore from Cloud Backups: Never restore an iCloud or Google One backup to a new device. Exploit payloads and persistence scripts can reinfect the clean handset upon sync.
3. Migrate Accounts on Clean Hardware: Using an uncompromised desktop workstation, immediately reset your primary email account, password vault, and mobile carrier account credentials. Revoke all active session tokens and enroll physical FIDO2 hardware security keys.
4. Permanent Device Retirement: Once an endpoint is infected with state-level firmware or baseband implants, factory resetting the partition table is insufficient. The hardware should be quarantined for academic research or permanently retired.