What the AnyDesk app leaves on an iPhone

Summary

• AnyDesk is legitimate remote-access software. US and Ukrainian agencies describe third parties, such as scammers, persuading people to run remote-access tools. None of the sources we read blames the company.
• The iPhone app keeps no database. On the image we studied it held a four-line connection file, three configuration files, a small preferences file and a text log of app starts.
• That is normal for an app that mostly shows and controls another device. The session itself is not stored in anything we read.
• The files still show that the app was installed, configured and started, and which versions ran. They hold a few connection lines whose fields are only partly understood.
• They do not show who connected, what was done, or whether anyone was deceived.

What the app does and who uses it

In its App Store listing, the vendor describes AnyDesk as remote-access and remote-support software for connecting to another device from anywhere. It names IT support staff, people working from home and students as its users, and says the app is ad-free and free for personal use. The steps it gives are short: install the app on both devices, enter the AnyDesk ID shown on the remote device, confirm the access request there, then control that device. Each installation therefore has an ID of its own.

The vendor's help page for iOS, which is marked as possibly out of date, says direct remote control of an iPhone is not available because of platform restrictions, and that viewing an iPhone screen remotely is supported. The in-session menu it lists includes chat, file transfer, screenshots, clipboard sync and recording. So on an iPhone the app is more often the controller or the viewer than the device being controlled. That reading is ours, drawn from the two vendor pages, and it matters for what the phone can hold: the other device, not the phone, is where most of a session happens.

Why this app matters to an examiner

Remote-access tools are built for legitimate support work, and the vendor names IT support staff among its users. They also appear in public warnings about fraud, where a third party persuades a person to give access. The sources below say so in their own words. We attribute each statement to its publisher, and we read each page ourselves. Figure 1 puts the dated items in order.

Government warnings. The FBI's Internet Crime Complaint Center (IC3) published a public service announcement on 10 November 2022 about scammers who pose as technical support, tell a person that a costly subscription is about to renew, and have the person download remote-desktop software and grant full control. The announcement describes the software generically and does not name a product. On 25 January 2023 CISA, the NSA and the MS-ISAC published advisory AA23-025A. It says that in October 2022 phishing emails led to downloads of legitimate remote monitoring and management software, naming AnyDesk and ScreenConnect, and that the actors used them in a refund scam. It says the actors downloaded the tools as portable executables that run without installation or administrator rights. It describes the actors having the victim log in to a bank account during the session and altering the displayed account summary to show an overpayment.

In January 2025 the Computer Emergency Response Team of Ukraine (CERT-UA) warned that unknown actors were sending unsolicited AnyDesk connection requests that claimed to be a "security audit" and used the agency's name and logo, as reported by Help Net Security on 20 January 2025. CERT-UA said it uses such software only after prior agreement. The report adds that the attacker needs the target's AnyDesk ID and that the app must be running on the target's device. The FTC's consumer advice on tech support scams, updated in September 2025, says scammers ask for remote access and then pretend to scan the computer. It does not name a product.

Scale of the category. The IC3 2025 annual report defines tech and customer support fraud as a subject posing as technical or customer support. It lists 47,794 complaints and losses of $2,134,675,818 in 2025. Figure 2 shows the loss figures against the other four top categories. The category is not specific to any app. We use it for context only.

The company's account. AnyDesk's press release of 16 May 2023, as published by Technode Global, describes an anti-fraud task force. It says the company has shut down several call centers and disconnected thousands of devices, with partners including scam-baiting content creators and Stop Scams UK. These are the company's own statements, and we did not verify the numbers.

Why the Lab chose it

We compared the apps found in the Lab's research images with what the open-source iLEAPP parser reads. The images held 731 distinct non-stock apps. The parser already read 51 of them, partly read 4 and did not read 676. We ranked the unread apps by public-record relevance and by how much a container held, and AnyDesk came fifth in our recommended list.

The ranking rests on three things: CISA advisory AA23-025A names the app, CERT-UA's warning names the app, and the category is a recurring subject of public warnings. It does not rest on the IC3 announcement of November 2022, which, as we read it, names no product. AnyDesk was present in 1 of the 9 images. Its container is small, so the Lab built a detector for presence, configuration and connection lines, not a full parser. A small container still needs a careful reading, because a reader that finds little may be tempted to report that nothing happened.

Method

We worked on read-only research images. We found the app's data container by its bundle identifier, listed every file in it and recorded the format, the line count and the key names of each text file, never the values. We marked the files the parser leaves unread, namely the purchase receipt, graphics and library caches, launch-screen snapshots and saved scene state. The configuration file that holds a certificate, a private key and tokens is reported by key name only, and any key whose name suggests a secret is withheld in the other files too.

We then wrote an iLEAPP plugin with three artifacts and tested it on synthetic fixtures built to the same shape: a container with every file, a line that is not a connection record, and a decoy folder that must add nothing; two containers, as after a reinstall; and a container that has only the log. The plugin has 6 unit tests and 7 recorded cases, and a full run on the real container finished without errors. No case data leaves the Lab. The plugin and the fixtures are in preparation for the open-source project and the Lab artifact repository, and the plugin has not been submitted.

What is on the device and what is not

A database is the exception for a thin app. Many apps that keep a history use a database; an app whose job is to show and control another device's screen has little to remember. That fits what we found. The container held no database, no message store and no embedded key-value store. It held a few text files, and Figure 3 lists them.

The log is the largest file and spans a long period, with banners for three versions. It records app starts, connections to the vendor's relay servers, DNS errors and defaults loaded from a managed configuration. It has no lines about sessions, file transfers or remote peers. That means the phone records that the app ran and how it reached the network. It does not record what the person did with it.

Table 1 sets out each file, what it holds, its value to an examiner and its limits. Then Figure 4 lets you test twelve things a reader might hope to find.

What an examiner can and cannot conclude

Can say. That the app's files were on the phone. That the app had been started, with a count of start banners and the versions they name. That it had its own ID, which can be compared with an ID in another record. That a small file held connection lines with the fields described above. These are indicators, and each should be given with the file and the image.

Cannot say. Who connected, from where, for how long, or with what permission. Whether the person was the controller or the controlled party, or who asked for the connection. What was seen or done. Whether a file moved. Whether the person was deceived, or whether money moved. A person can use this app for entirely ordinary work, and the same files appear. The files are consistent with ordinary use as well as with misuse.

Absence. No session lines does not mean no session. The phone might never have kept one, the app might have rotated a log, or the session might have been controlled from another device. The Lab's earlier work on empty reads gives the same rule: report that a source held nothing, and say what that source could never have held (LAB-TR-0006, LAB-0005).

Next steps. Questions about who and what belong with records outside the phone: the other device, bank and call records, and whatever the service holds. Whether the service holds anything useful is not something this study measured. That would be a matter for legal process.

What this does not prove

Sources

Every claim and number, with publisher, date and URL. We read each page on 6 November 2026. The CERT-UA page itself did not load in our tool, so that item rests on two news reports that link to it. Numbers we could not read ourselves were left out. Lab reports are cited only for method.

Version history and corrections

Corrections log

No corrections have been published for this article. Corrections to any article are listed on Corrections, with the version they apply to.

Related

The parser and the synthetic fixtures are in preparation for the open-source project and the Lab artifact repository.