Image, analyze, and report, mobile device investigation exercises for stalkerware and unauthorized monitoring
At Halcyon Biotech, research scientist Elena Vasquez reports that a colleague seems to know private details he shouldn't. IT images her company Android phone. Determine whether an unauthorized monitoring app was installed, what data it could access, and where it sent that data.
A company-issued iPhone belonging to Halcyon Biotech's facilities director, Ren Okafor, is enrolled in the company's Jamf MDM. During a routine audit, IT notices Settings > VPN & Device Management lists a second management profile Jamf never pushed. Determine what that profile can do, how it got there, and whether it is the source of a suspected leak.
A smishing text sent to dozens of Halcyon Biotech employees claimed their carrier required a critical system update. One recipient, warehouse supervisor Tomas Reyes, tapped the link on his personal Android phone (used for the company's BYOD banking-app-based expense reimbursement) and later found two unauthorized transfers from his linked bank account. Determine how the app operated and what it actually did.
Halcyon Biotech's Chief Scientific Officer, Dr. Amara Ibe, is negotiating an exclusive licensing deal, and confidential term sheets appear to have reached a competitor before they were shared internally. Her company iPhone shows no jailbreak, no suspicious apps, and no unusual permission grants. Using the open-source Mobile Verification Toolkit (MVT) against a full filesystem extraction, determine whether her phone was compromised without any action on her part.
An HR complaint alleges that shift supervisor Grant Okonjo sent and then deleted harassing messages to a subordinate through Halcyon Biotech's internal TeamChat app. His Android phone is imaged the same afternoon. Determine exactly what can and cannot be proven about the deleted messages, given what actually survived.
A warehouse employee at Halcyon Biotech reports unusual battery drain and worries a coworker somehow knows where he's been after hours. A junior analyst finds a pre-installed app with alarming permissions and wants to flag it as spyware. Determine whether that app is actually the problem, and find what is.
Contract researcher Priya Anand returns her Halcyon Biotech iPhone factory-reset on her last day, saying it was 'just habit.' The device itself now holds nothing useful. IT pulls the last backup taken under the company's managed Apple ID enrollment before the reset. Determine what that backup can prove that the wiped phone cannot.
A field technician's Android phone, used to approve equipment work orders through a corporate e-signature app, appears to have approved a purchase order he says he never touched. He'd installed a 'Battery Doctor Pro' app the week before to fix poor battery life. Determine what that app actually did with the Accessibility Service it asked for.
Halcyon Biotech's CFO loses cellular service for eleven minutes one afternoon, then starts receiving password-reset confirmations for accounts he never touched. His iPhone shows no jailbreak and no new apps. Determine whether his own SIM was the attack surface, using nothing but artifacts already on the phone, and be clear about what those artifacts cannot prove.
Halcyon Biotech's VP of Business Development loses her cellular eSIM entirely mid-afternoon, no error, no outage message, the line simply stops appearing in Settings. Minutes later, someone begins resetting her banking and Slack sessions from a new device. Determine whether her own phone's artifacts can prove the eSIM was remotely transferred rather than lost to a bug, and be clear about what those artifacts cannot prove about who did it.