How would you know a phone has been compromised?

Summary

• The best-documented signs in the public record are small and ordinary: a battery that drains quickly, updates that fail. In one widely reported case they were the first things the owner noticed. They are also common on healthy phones, and we read no study of how often they appear on infected ones.
• Advanced "zero-click" attacks need no mistake from the owner. That is why a lack of any odd link or message proves nothing.
• Apple and the research groups agree on one thing: notifications and public tools help, but none gives a clean bill of health. Apple's notices are not real-time alerts, and the toolkit's own documentation says public indicators are insufficient to call a device clean.
• U.S. and international guidance for people at higher risk is mostly about shrinking the attack surface: updates, Lockdown Mode, an occasional full restart, and expert help.
• An examiner can report what a device shows and what it cannot show. "No evidence found" is a statement about the data, not about the person.

A case that began with a battery

Ghanem Al-Masarir is a Saudi satirist who lives in London. Middle East Eye reported in July 2022 that his iPhones had batteries that were dying quickly and refused to update with the latest software, and that the Citizen Lab, a research group at the University of Toronto, then ran a forensic investigation and found the phones had been hacked with Pegasus, the spyware sold by NSO Group.

In January 2026 the same outlet reported that the High Court in London awarded him a total of £3,025,663 against the Saudi state. According to that report the judge, Mr Justice Saini, accepted that Saudi authorities infected his phone with Pegasus acquired from NSO Group in 2018, and concluded that a physical attack on him in London that year was directed from Riyadh. The report adds that the kingdom's claim of state immunity was rejected in 2022 and that its appeal was struck out in 2024 after it failed to pay court costs. We read that account in the press, not the judgment.

The reason to tell the story here is narrow. Nothing in the reports says the battery or the failed updates proved anything at the time. They are the signs the owner remembered, and the forensic work that followed is what established the infection.

Why the best spyware is quiet

Some of the most capable spyware reaches a phone through what researchers call a zero-click exploit: the phone processes a malicious message by itself and the owner does nothing. In September 2021 the Citizen Lab described one such exploit, FORCEDENTRY, a zero-day zero-click attack against Apple's iMessage that targeted an image rendering library. It was found on the phone of a Saudi activist, which the lab found had been infected with Pegasus in March 2021. Apple fixed the flaw the same day the lab published, as CVE-2021-30860.

This matters for advice. "I never clicked anything" is true for many victims of this class of attack, so it does not rule one out. It also means a long list of rules about suspicious links, useful as it is against ordinary scams, is not a defense against the rarest and most expensive attacks.

It also means that sound habits and honest uncertainty go together. Apple says its threat notifications go to a very small number of people it believes were individually targeted by mercenary spyware, often because of who they are or what they do, and that most people will never be targeted. That is the right frame for the rest of this article: most phone trouble is ordinary trouble.

What an ordinary person can notice

Figure 1 sets the signs people usually list beside their ordinary explanations. Apple's own support article on fast battery drain gives several: batteries wear out over time, and after an update some background tasks keep running and can affect battery life and heat for a few days. Wear, a recent update, poor signal and a heavy app are far more common causes than spyware, and each is easy to check.

No single sign proves anything. The only sign in the list that comes from a party able to see inside the system is a threat notification, and Apple says that its investigations cannot reach complete certainty and that it does not say what triggers a notice.

What checking can and cannot show

Four routes appear in the public record. Figure 2 compares them; the text below adds what each cannot tell you.

Notifications

Apple says it has notified users in more than 150 countries since 2021, in the lock screen, in settings, by e-mail and as a banner on the account page after sign-in. In its report on a former European Parliament member, the Citizen Lab noted that Apple had sent him threat notifications on 2 March 2023, 29 August 2023 and 10 April 2024, that he did not recall them, and that such notices are typically sent in batches, often months after targeting. In that case the lab found high-confidence infections on 21 October 2022 and on 6 and 7 March 2023, and warned that other infections could have gone undetected because of the limits of forensic data.

The toolkit

The toolkit's method was reviewed in July 2021 by the Citizen Lab at the request of Amnesty International and Forbidden Stories. The lab found the core forensic methods sound and independently confirmed that they identified Pegasus in four iTunes backups. It also said the review covered a sample of devices and backups and not the wider investigation. In practice the toolkit is where an expert starts, not where an ordinary reader finishes.

The restart log

Kaspersky's method looks for reboot delays caused by "sticky" processes and a path it saw in Pegasus cases. Two cautions came from the company itself: it is not a silver bullet, and some uninfected phones had two or three delay notices, so delays alone prove nothing. A security vendor, iVerify, reported in October 2025 that iOS 26 overwrote this log at each restart, which would erase older entries, and in February 2026 that iOS 26.2 returned to creating a new log. That is a vendor's account, and it also says the fix does not restore entries already lost. The lesson is general: how long evidence survives depends on the software version.

What public guidance advises

For people who think they may be targeted because of their work, the public advice has a consistent shape.

• Keep the system updated. Apple's general advice includes keeping devices updated, and the FORCEDENTRY flaw was closed by an update.
• Consider Lockdown Mode. Apple describes it as an optional, extreme protection for a very small number of people. It blocks most message attachment types and link previews, restricts some web technologies and incoming FaceTime calls from people you have not contacted, and stops configuration profiles being installed. Apple says calls, plain-text messages and emergency features keep working.
• Restart the phone fully from time to time. The U.S. National Security Agency's 2020 mobile guidance recommends a weekly restart, according to the Associated Press. The same report says the agency acknowledged that it works only sometimes, and a Citizen Lab researcher said a determined operator could simply send another zero-click exploit. Its value is making a persistent attacker work harder.
• Get expert help early. Apple points to Access Now's Digital Security Helpline, which says it gives free technical support to civil society groups, journalists and activists around the clock after a vetting step.

One caution on the restart advice, from the examiner's side: a restart can also remove memory-only traces. If you have a specific reason to think you are being targeted, ask the expert helping you before you restart, update or reset the phone.

What an examiner can and cannot conclude

An examiner can say that a named indicator is present on the phone, say which file or record it came from, and describe how long that store reaches back. An examiner can also say that a device-maker notice exists, give its date, and note that it is a statement by the company and not a finding about the phone.

An examiner cannot call a phone clean because no indicator was found. Public lists lag behind new tools, many records are rolling stores that overwrite themselves, and some operators try to remove traces. In its 2022 report on El Salvador the Citizen Lab noted that Pegasus can delete evidence of exfiltration, so the absence of that evidence does not show that nothing was taken. For the same reason an examiner cannot assign blame to a company or a government from a device alone: in the European Parliament case the Citizen Lab found high-confidence infections but said it could not conclusively attribute them to a government agency and named no customer. Lab work on empty results explains when "nothing found" may be read as "nothing happened" (LAB-TR-0034).

What this article does not claim

Sources

Every claim and where it comes from. Pages were read on 2026-11-08. The Washington Post, the BIS release and the NSA document itself could not be read by the Lab's tools and are not relied on here. Numbers that could not be sourced were left out.

Version history and corrections

Corrections log

No corrections have been published for this article. Corrections to any article are listed on Corrections, with the version they apply to.

Related