“If there are any traces of suspicious activity, the script will print out SUSPICION or DETECTED lines with more information and detected IOCs, and that would mean that the device was most likely compromised.”
Kaspersky had to ship its own scanner to find this compromise. The tool parses a backup and flags SMS attachments touched alongside location service changes and ImageIO preference files. Apple sells the iPhone on security and gives owners no way to inspect it. The victim’s only forensic window is a backup file and an antivirus firm’s Python script.