Sample report
Sample report written from an AI-Dossier by a fictional client
Seven pages from an invented case, marked Sample, fictional data. Read it here or download the PDF. The full sample dossier needs a short form.
Resources
Read what we know.
A short, curated set of threat briefs, release notes and fact sheets. Every item carries its date.
Featured: fact sheet
SectraTEK fact sheet
Editions, evidence types, the detection engines, dated SectraTEK Intelligence totals, support and security at a glance, on one page you can print.
All resources
Research
A warning from Apple: what a threat notification means, and what Lockdown Mode promises
Apple has warned users in more than 150 countries since 2021, most recently in 110 on 13 August 2026. A notification is a high-confidence warning, not proof; Lockdown Mode is strong, but Apple says only that it knows of no successful attack.
Research
AdFection: how an advertisement became a delivery route for spyware
According to Citizen Lab, an Israel-based ad-tech firm let customers aim an advertisement at one device, and servers that Citizen Lab links to a spyware vendor then profiled that device. An ad impression alone, the lab stresses, establishes neither targeting nor infection.
Research
The advanced Android acquisition: more of the phone, still no lab required
An advanced Android acquisition goes beyond a bug report with a fuller app inventory, a snapshot of running processes and, when included, a record of network use. SectraTEK Research Lab explains what SectraTEK reads in it and how findings reach the client.
Research
AI and the exploit clock: sorting Calif's 2026 claims
In 2026 Calif says AI models helped it build a worm demonstration, test a Mac memory defense and stage a jailbreak in Paris. The details are withheld; what can be checked is the gap between a fix and a public crash file.
Research
Android in 2026: the scam starts with a phone call
The most inventive Android threats of 2026 do not break the phone; they persuade its owner. A staged call, a sideloaded remote-control app and a card relay over NFC show how far a conversation can go.
Research
The Android bug report: a quick, honest read of what the phone reports about itself
An Android bug report is the diagnostic bundle a phone produces about its own state, logs and settings. SectraTEK Research Lab explains what SectraTEK examines in it, where it falls short of a full extraction, and how the findings are packaged as a prioritized, evidence-referenced AI-Dossier.
Research
What an Android phone kept about itself, and how we read it
An Android full-filesystem extraction holds the apps, permissions and records a handset kept about its own life. SectraTEK turns that record into rated, evidence-referenced findings a client can act on.
Research
Android's patch level: how to read a security bulletin
Google marks only a few Android bulletin entries each year as possibly exploited, and it chooses its words with care. Reading that wording, and the patch level on a phone, tells you more than any zero-day headline.
Research
Coruna: twenty-three exploits, one web page, three kinds of operator
Google described a kit of 23 exploits in five chains for iPhones on iOS 13 to 17.2.1, hidden behind web pages. Within a year, according to Google, it passed from a surveillance vendor's customer to a suspected espionage group to criminals stealing cryptocurrency.
Research
DarkSword: the iPhone attack built from web pages
Google, Lookout and iVerify each documented a chain of six iPhone flaws, written entirely in JavaScript, that started when a phone visited a page. Several operators used it on iOS 18, it deleted crash reports behind it, and Google and Lookout agree iOS 26.3 and 18.7.3 fall outside it.
Research
The evidence that erases itself
For years one small system file preserved traces of older spyware, until early iOS 26 releases began overwriting it at every restart. Newer implants go further: they delete crash reports, vanish on reboot or leave when analysts appear.
Research
From targeted tool to public code: how an iPhone exploit kit leaked
Two weeks after Google described DarkSword, a newer build was reported on a public code site, and iVerify says variants followed. Our assessment separates what is confirmed from one vendor's claims, and says who stays at risk.
Research
Hexacon 2026: what Paris showed about the phone in your pocket
At a two-day offensive-security conference in Paris, researchers showed an iPhone restarting into a root shell and a run of Android and boot-level research. Almost none of it has been released, and that gap is the story.
Research
How stalkerware hides from its victim, and from antivirus
A study of 82 Android stalkerware builds and an independent test of 13 security products explain why these apps persist: they ask for accessibility rights, restart themselves, hide behind generic labels and split into a compliant app and a hidden one. The same test shows why a warning on the victim's screen can itself be dangerous.
Research
The iOS backup: an examination that starts from a file your client already has
An iOS backup is a copy of a phone's apps, data and settings made through a computer. SectraTEK Research Lab explains how SectraTEK examines it for known-bad indicators, risky apps and exposed configuration, and where a backup falls short.
Research
The full file system: the deepest look SectraTEK takes at an iPhone
A full-filesystem extraction is the most complete copy of an iPhone that an examination can start from. SectraTEK Research Lab explains what SectraTEK reads in it, what even this evidence cannot show, and how a long examination is packaged for a short, defensible report.
Research
The iPhone's own logbook, read for signs of compromise
A sysdiagnose is the diagnostic archive an iPhone writes about itself: logs, crash reports and system state. SectraTEK Research Lab explains how SectraTEK examines it for permissions, known-bad indicators and exposure, and packages what it finds as a graded, evidence-referenced AI-Dossier.
Research
Memory tagging arrives on the iPhone: what MIE changes
Apple's Memory Integrity Enforcement, built into the newest iPhone chips, aims to make the class of bug behind many exploit chains harder to use. Apple says it cut off six real chains it rebuilt; outside testers have claimed progress on a Mac, and no published evidence confirms a bypass on an iPhone.
Research
Messaging apps as the front door: five routes, five levels of proof
Messaging apps hold more of an owner's life than any other app, and attackers have noticed: group invitations, linked-device QR codes, link previews and one demonstration that needs only an incoming call. The evidence behind each route is uneven, and this article grades it route by route.
Research
Mobile threats by the numbers: what the data supports, and what it cannot
Ninety zero-days were exploited in the wild in 2025 and 15 of them hit mobile operating systems, according to Google. The headline numbers are all floors drawn from someone's telemetry: here is what each measures and what no one has measured.
Research
What the phone said to the network, without reading a word of it
A network capture shows who a phone talked to, when and how often, even when every byte is encrypted. SectraTEK reads that metadata, ranks what stands out and carries it, in an AI-Dossier, to the report a client can act on.
Research
No tap required: how zero-click and one-click attacks reach a phone
A zero-click attack needs nothing from the phone's owner; a one-click attack needs a single tap, open or scan. Cases documented from 2021 to 2026 show how each works, why so little remains afterward, and how rare these attacks are.
Research
Pre-infected: when the phone ships with the problem
Some Android phones, tablets and streaming boxes carry malware before the first boot. Researchers describe system-level apps that cannot be removed and firmware backdoors used for ad fraud, with the caution that a supply-chain link is not proof of intent.
Research
Proof on the phone: how researchers confirm commercial spyware
Confirming that an iPhone ran mercenary spyware takes more than a warning: published cases rest on device logs, server fingerprints and message accounts. That standard explains why so many phones stay 'inconclusive', and why a negative is not an all-clear.
Research
The spyware industry in the courts: injunctions, entity lists and sanctions
Courts, trade rules and sanctions are now part of the story of commercial spyware. A US court enjoined one vendor from attacking WhatsApp, the Commerce Department's entity list and Treasury sanctions have shifted, and a voluntary international code is being drafted. Each item here carries its date and its status.
Research
Stalkerware: the spyware installed by someone who knows the passcode
Stalkerware is bought by people who know the victim, not built by governments. The counts are floors from one vendor's users, and the first rule for anyone who finds it is safety, not removal.
Research
The flaw Apple cannot patch: boot ROM bugs, usbliter8 and a conference talk
The first code an iPhone runs is etched into silicon, so a flaw there cannot be patched. One was published for A12 and A13 chips in June, and a Hexacon talk described a broader approach; both need the phone in hand.
Research
The jailbreak that survives a restart: what Calif showed on an iPhone 18 Pro
On 16 October the research firm Calif showed an iPhone 18 Pro on iOS 27.0.1 restarting, unlocking with its normal passcode and offering a root shell again, according to press reports. Calif has released no tool, bug list or date, and Apple has not commented.
Research
The picture is the payload
Phones decode photos, audio and fonts constantly, often before the owner looks. A run of 2025 and 2026 cases shows why those decoders are targets, how some chains used a message with no tap, and how researchers keep finding the flaws first.
Research
The QR code in the PDF: how documents move the attack onto your phone
Some of the most effective PDF attacks contain no exploit at all. A picture of a QR code sends the reader from a monitored computer to an unmonitored phone, and a PDF reader in an app store can turn out to be an installer for something else.
Research
When the cable talks back: USB attacks and the examiner's own risk
A phone is not only attacked over the air. A cable, a lookalike charger or an extraction device can talk to the kernel, and the tools examiners connect to hostile phones parse hostile data. Both facts argue for isolation, updates and a second opinion.
Research
When the document is the exploit: PDF parsers, fonts and the iPhone
In September Apple fixed a flaw in the graphics engine that renders PDFs and said it may have been used in an extremely sophisticated attack on specific people. Here is what is known about that flaw, what researchers published afterward, and what nobody knows about how it was delivered.
Research
Where a phone shows the signs: browsers, sensors, documents and traffic
Mobile compromise rarely announces itself, yet the documented attack routes start in the same four places: the browser, the sensors, the documents that arrive and the traffic nobody watches. Independent research shows why those places hold the evidence, and what they cannot prove.
Research
Who can still jailbreak an iPhone in 2026
Public jailbreaks still exist, but only for older chips and older software; for current iPhones none has been released. A jailbroken phone is a different kind of evidence source, and so is a phone whose owner was told that one is on offer.
Fact sheet
SectraTEK fact sheet
Editions, evidence types, the detection engines, dated SectraTEK Intelligence totals, support and security at a glance, on one page you can print.
Video
Product film: SectraTEK, from raw evidence to answers
The SectraTEK film, with chapters that take you straight to any part. Two short clips are on the Videos page.
Glossary
Glossary
Plain-language definitions of the terms you meet in SectraTEK and in mobile threat examinations.
Procurement pack
Procurement pack
The documents and answers a procurement team asks for, in one place: security overview, accessibility, license terms, pricing and how to request a quote.
Sample report Short form
Full sample dossier
The complete AI dossier of the same invented case: the examination data behind every finding, with the evidence integrity record. Marked Sample, fictional data.
Threat brief
Reading an indicator match: where to look next
A match is a lead with context, not a verdict. How to read the family, the campaign and the evidence around a match before you decide what it means.
Release notes
SectraTEK 1.0: what is new
Guided collection, a clear result from every engine, a dossier that waits for your approval and evidence that stays where it is. What is new, in plain language.
Threat brief
Configuration profiles on iOS: expected, unusual, managed
Profiles are how organizations manage iPhones, and a place an unwanted change can hide. How to tell an expected profile from one that deserves a second look.
Threat brief
Broad permissions on Android: what to look at first
A few permissions give an app a great deal of reach. Which to check first on an Android phone, and how to read them against what the app is for.
Nothing matches your search
Try a shorter phrase, or browse by evidence type.
Video
The product film.
It plays only when you press play.
Product film5:32