Deep surveillance apps
Collect messages, photos, location, browser history, microphone access, and app data. They often hide behind generic names, accessibility abuse, notification suppression, or sideloaded profiles.
Threat education that treats the user like an adult.
A compromised phone rarely announces itself. DeSpy looks for overlapping technical signals that standard antivirus checks often miss or cannot see from inside the device sandbox.
Coercive monitoring
Frequently installed by someone with physical access. Common IoCs include unknown device administrators, persistent location polling, strange battery patterns, suspicious app permissions, and cloud account access from unfamiliar devices.
Commercial tracking stacks
May appear as parental control, safety, or productivity software while quietly exporting telemetry. DeSpy highlights the exact bundle IDs, package names, domains, and persistence mechanisms that triggered concern.
Remote policy control
Malicious or abusive management profiles can enforce VPNs, certificates, restrictions, app installs, web filters, and remote wipe capability. DeSpy flags unknown profiles and explains what the profile can control.
Security boundary changes
Rooting or jailbreaking can be user-approved, attacker-driven, or left behind after a repair. Indicators include suspicious filesystem paths, package managers, tampered trust stores, hooks, and debug services.
Telemetry outside the phone
Compromise may live in the account rather than the handset. DeSpy correlates sign-ins, OAuth grants, app passwords, device history, and user-provided context with extracted device artifacts.
What suspicious evidence can look like.
| Signal | What it does | Why it matters | Common evasion |
|---|---|---|---|
| Unknown MDM profile | Controls policies, certificates, app installs, traffic routes | Can turn a personal device into a managed endpoint | Uses bland organization names or hides inside legitimate enrollment language |
| Accessibility service abuse | Reads screens, clicks UI, captures notifications | Often bypasses app-level permission expectations | Masquerades as battery, cleaner, or support tools |
| Suspicious OAuth grant | Allows third-party cloud access without a password | Persists after password changes unless revoked | Uses plausible app names or broad scopes |
| Jailbreak/root artifacts | Shows system trust boundary changes | Expands what surveillance tools can access | Deletes visible apps while leaving hooks, paths, or services |
| Unexpected app container traces | Reveals installed or previously installed tools | Can identify exact surveillance families | Renames packages, delays sync, or removes launcher icons |
The extraction funnel.
DeSpy is designed to explain the full path from raw evidence to risk probability, without asking the user to trust a black box.
Extract device dataLogical and forensic acquisition paths collect the strongest available Android and iOS evidence without changing the protected scanning engine.
Pull safe cloud telemetryAccount imports add sign-ins, OAuth grants, app passwords, device history, and other off-device context.
Correlate signalsDeSpy compares extracted artifacts, account activity, user context, threat intelligence, and known IoCs.
Explain the riskThe report shows what was found, why it was flagged, what research supports it, and what the user can do next.
A report designed to be read under stress.
Evidence-first findings
Each detection describes the artifact, the source, the confidence, and the direct reason DeSpy flagged it.
Research-backed context
Findings carry links to vendor research, public reports, package references, and relevant platform documentation.
Actionable next steps
Users get practical containment and verification actions: revoke grants, inspect MDM, rotate credentials, preserve evidence, or escalate.
Regression-tested intelligence
Threat updates and dependency changes pass golden-device simulations before entering the staging library for review.
