Where a phone shows the signs: browsers, sensors, documents and traffic

Our assessment: four places hold the evidence

The published research points to a common pattern. Attacks begin with something owners do every day: open a link, receive a file, grant an app a permission, keep the phone online. Ordinary adware, trackers and stalkerware use the same four surfaces at far higher volume and lower sophistication. Most activity on each surface is benign. The Lab’s assessment is that these are the places where misuse becomes visible when something is wrong, and that the traces there are small, differ by platform and expire.

The browser: a standing door

Google’s Project Zero documented five complete iPhone attack chains built on 14 vulnerabilities: seven in the browser, five in the kernel and two sandbox escapes. They were delivered by hacked websites between 13 September 2016 and 22 January 2019[S1]. Citizen Lab’s 2021 analysis of the Predator spyware found one-time links sent over WhatsApp to lookalike news sites; on one iPhone the link opened in Safari and the implant appeared about two minutes later. The researchers did not obtain the exploit code, so the browser step is their inference[S3].

The share has shifted since. Google’s Threat Intelligence Group counted browsers in under 10 percent of 2025 zero-day exploitation, a marked fall from 2021 and 2022[S4]. That does not mean the browser stopped mattering. Exploits moved into other components, and the web engine remains the main internet-reachable route for links, advertisements and one-click chains.

The limits are practical. Browsing history can be cleared, private browsing leaves less, and a visit to a bad page is not proof of exploitation. The Project Zero implant did not survive a restart[S2], and in Operation Triangulation the exploit and its message were deleted after use[S10]. A browser record can show where a phone went. It cannot show what happened next.

Camera and microphone: capability is not use

Both platforms treat these sensors as sensitive history. Apple’s App Privacy Report lists, for the past seven days, when apps accessed location, photos, camera, microphone and contacts; it needs iOS 15.2 or later and must be switched on[S8]. Android 12 and later offer a privacy dashboard with a timeline of camera and microphone access, an on-screen indicator and device-wide sensor switches[S9].

Permission requests are common. In a random sample of 24,000 no-charge apps, 56.3 percent of iOS apps and 21.4 percent of Android apps asked for the camera; 26.2 percent and 9.7 percent asked for the microphone. The Android system camera app explains part of the gap, and the study did not measure apps asking for both[S5].

What documented implants did matters as much. Project Zero’s 2019 iOS implant did not record live audio or video; it uploaded existing material such as voice memos, message databases and location[S2]. Citizen Lab found a hot-microphone recorder in the Predator Android sample, and did not confirm microphone or camera features on iOS[S3]. Stalkerware, which the Coalition Against Stalkerware defines by the absence of the owner’s consent and persistent notification[S14], is the commonest sensor abuse. A permission shows capability, not use.

Documents and attachments: the files that arrive

Project Zero’s analysis of the FORCEDENTRY attack describes an iMessage file named like an image that was in fact a PDF; the phone identified it by content, and a flaw in a decoder gave code execution with no user interaction[S13]. Kaspersky described an iMessage attachment of about 242 KB that triggered code with no interaction, after which the message and exploit were deleted. The most useful trace was not the document but evidence of a deprecated backup-related process[S10].

Citizen Lab’s 2023 analysis of the BLASTPASS attack found a chain that worked on a fully patched iOS 16.6 through attachments carrying malicious images, and the researchers believed Lockdown Mode would block it[S16]. Fixes and hardening change the picture quickly, so any statement about a bug needs its date.

Most PDFs and attachments are harmless. The documented risks are parser flaws and documents used to carry phishing, which is why the file’s presence, its source and the phone’s software version belong together.

Background network activity: a busy baseline

An idle phone is not quiet. A Trinity College Dublin study found that iPhone and Android handsets, minimally configured and untouched, contacted Apple or Google on average every 4.5 minutes, and that pre-installed apps connected without being opened. It tested two handsets in 2021, and the vendors disputed parts of the method[S6]. The average app contacted 2.7 (Android) or 2.4 (iOS) tracking domains at start-up[S5], and almost half of 400 popular apps reached tracker domains without consent[S7]. Volume and destination are context, not verdicts.

Against that baseline the cases stand out by pattern. The Project Zero implant asked its server for commands every 60 seconds, uploaded location up to once a minute over plain HTTP and showed no indicator[S2]. Kaspersky first noticed Operation Triangulation from suspicious traffic on a corporate Wi-Fi network[S10]. Citizen Lab confirmed Paragon’s Graphite on two journalists’ iPhones through device logs showing requests to a server matching a known operator fingerprint, not through a malicious file[S11].

What each surface cannot tell you

Amnesty International’s Security Lab examined 67 phones for the Pegasus Project: 37 showed traces of Pegasus and 30 were inconclusive. Android phones logged less of the kind of information the work needs, although three of the 15 Android phones still showed signs of targeting[S12]. The lesson is not that Android is safe or iOS is exposed. It is that the amount of retained evidence varies by platform and version, and that an examiner has to say which evidence existed. Encrypted traffic hides content, leaving domains and timing. A permission is not a use, a connection is not intent, and a document is not a verdict.

What this means for examiners

Treat each surface as context, then corroborate. Ask for the phone’s software version and the period each record covers before reading any record. Preserve evidence before updating or restarting, because some records roll over. Owners can turn on Apple’s App Privacy Report or check Android’s privacy dashboard now, so that a history exists later [S8][S9].

What the Lab is watching

Three gaps limit every conclusion. We found no public median for how long a mobile compromise lasts; the nearest figure, 14 days in 2025, is Mandiant’s enterprise median and is not mobile data[S15]. Documented cases range from months (Graphite, January to at least April 2025) to years (Triangulation, traces from 2019 to 2023) [S11][S10]. We found no independent 2024 to 2026 study of apps holding both camera and microphone access, and no primary figure for the share of background traffic that is unusual. Until those exist, counts of detected cases measure what was found, not what happened.

That is also why the Lab reads the headline numbers cautiously. A figure drawn from one vendor’s customers, or from a two-handset test, describes that sample well and the wider world poorly. We will keep reporting each number with its publisher, its year and its limit, and we will say when a better study fills a gap. Readers who need one habit from this article should take this one: ask what the evidence could have shown, and for what period, before asking what it did show.