Detecting unauthorized MDM or stalkerware on iOS without Mac

Thank you so much for the detailed replies! I really appreciate the specific tool recommendations, and I will definitely put them to the test. If any other tools or methods come to mind, please feel free to share them!

To give more technical context: I have already escalated this with Apple Support and discussed it with various IT specialists, but we are all a bit stumped. A standard wipe is unfortunately not working as expected. Every time I attempt a DFU restore, the process crashes and fails to complete. When it reboots, it always forces the exact same previous account/environment setup.

Furthermore, I noticed that one of my Passkey's has stopped working from my iCloud Keychain, and neither Apple Support nor the backend service provider has been able to give an answer as to why or how that happened.

To be clear, I am not entirely sure what the root cause is. Whether it is an unauthorized Mobile Device Management (MDM/DEP) profile, some form of spyware/stalkerware/shadow-IT, or something else entirely. Visually, there is nothing suspicious showing up in the enrollment or settings menus. In fact, during my discussions with Apple Support, even their team was completely left speechless by this behavior. The device is NOT jailbroken, as I have never done anything like that myself.

Ultimately, my main goal here is to perform digital forensics. I want to extract raw data and analyze these anomalies to understand exactly what is going on, rather than just trying to bypass the issue.

[Edited by Moderator]

The device was bought secondhand from Reseller company.

I also need to add some important context regarding security: my old phone number (which is no longer in use because it was compromised multiple times) was never used directly on this specific device. However, the online account associated with that data leak was previously logged into this phone.

The situation is highly complex, and at this point, I honestly feel I might need a reliable digital forensics tool to get to the bottom of this.

Thank you! Also, I have tried restoring via iTunes, but I've had to switch entirely to the new Apple Devices app. My iTunes doesn't recognize the iPhone at all. No matter what I do, the device simply refuses to show up there.

[Edited by Moderator]

The device was bought secondhand from Reseller company.

I also need to add some important context regarding security: my old phone number (which is no longer in use because it was compromised multiple times) was never used directly on this specific device. However, the online account associated with that data leak was previously logged into this phone.

The situation is highly complex, and at this point, I honestly feel I might need a reliable digital forensics tool to get to the bottom of this.

Thank you! Also, I have tried restoring via iTunes, but I've had to switch entirely to the new Apple Devices app. My iTunes doesn't recognize the iPhone at all. No matter what I do, the device simply refuses to show up there.

According to the iMazing tool, there is no MDM (Mobile Device Management) or DEP (Device Enrollment Program) active on this phone. Do you have any insights or ideas on what could be causing this? Could it potentially be a hardware issue?"

[Edited by Moderator]

I agree, it's definitely pointing towards hardware. I'd love to hear your thoughts on a few things:

1. Worst-case scenario: What kind of damage are you suspecting, and what do you speculate is the absolute worst outcome here? Which specific component do you think is failing?
2. Diagnostics: I’ve already run Apple’s self-diagnostics, but are there any other tools you’d recommend? What exactly should I be testing right now?
3. Repairs: This issue has caused a slight dent in my setup's reliability/image, and I'm unsure if it can even be fixed. Do you know if anyone actually takes these specific cases in for a proper hardware investigation?

I'd really appreciate your insights on this!

Thank you! I usually buy my devices new, but this time I made an exception and bought my gear from a reseller. It was a trusted one, Swappie. It's a really huge company in Europe, and I think I got a model with depot parts or software... This is, like, a really great thing, that first the journey with those Androids is what it is, and then this comes along, so yeah..

I don't know if I can find a way to report this somewhere, because the company's needs to take responsibility for these devices and refurbished devices. They can cause serious harm if they aren't investigated thoroughly before selling. Every defective model belongs in the trash now, not sold...

In short: Losing the phone itself is a minor issue. The real loss is the data. What are my options? Will they even look into a single consumer's case unless many people are affected?

Also, what kind of evidence or data would I need to provide to file a consumer protection claim, considering the retailer is the one who messed up badly here? 

I originally switched to iPhone specifically for privacy and I actively use Lockdown Mode, so it's a shame the trusted retailer caused this situation.

Thank you for your response.I truly appreciate you taking the time to help.

Why I am turning to this community:

This technical assessment is shared because the underlying threat vector is universal, potentially impacting any individual within the mobile ecosystem.

Transitioning to an iOS device was a deliberate choice to establish a trusted baseline, given Apple's focus on privacy and security architecture. Because finding independent firms specializing in rogue consumer Mobile Device Management (MDM) on the open market is exceptionally difficult, the Apple community is the most qualified environment to seek insights on Apple architecture.

To ensure this matter is addressed objectively, this inquiry follows a strictly data-driven approach focused on hard evidence. My immediate objective is to gather forensic-grade data and irrefutable, tool-generated technical logs that can be formally presented to regulatory and law enforcement authorities.

Technical Statement: Scope, History, and Legal Status

• Objective: Investigate device security, system integrity, and unauthorized persistence
• Ownership: All devices, accounts, and network services are strictly personally owned and privately purchased. No corporate or enterprise affiliation exists.
• OPSEC & Data Redaction: All regional markers, localized language strings, and metadata have been intentionally redacted from this report and the attached screenshots to maintain some security (OPSEC) and protect personal anonymity.
• Current Indicators (iOS):Systemic anomalies observed post-activation prompted formal log requests from financial, insurance, and healthcare providers. Initial reviews confirm unauthorized endpoint interactions, which are now being aggregated for independent audit.
• Regulatory Status: Reported to Data Protection, Cyber Security Center (Vulnerability Unit), and Telecom Carrier DPO authorities. Jurisdictional allocation is unresolved due to technical complexity; no consumer protection claims are engaged.
• Current Status (Legacy Android MDM): Authorities have withheld technical data, such as the Android Tenant ID, due to consumer-level limitations. Without this critical identifier, it is highly hypothesized that the persistence migrated to the current iOS device via linked accounts or cloud synchronization. Progression remains stalled due to this jurisdictional deficit.

Incident History & Incident Timeline

• Verified Android Compromise: Predecessor Android device had a verified, unauthorized enterprise MDM profile. Profile ownership and Tenant ID remain unknown due to local regulatory disclosure restrictions.
• Deployment Vector Hypothesis: Based on commercial B2B hardware security consultation, the initial Android deployment is hypothesized to have occurred via automated enterprise enrollment (such as Google Zero-Touch). The legacy routing source is suspected to stem from an un-proprovisioned device identifier linked to a previous corporate infrastructure environment.
• Network Vector (MSISDN): The suspected primary root cause is a verified, compromised legacy phone number (MSISDN). Case escalated to Telecom DPO; findings are pending.
• Cross-Platform Observations: Identical configuration anomalies and MSISDN-linked behaviors re-emerged post-transition to the current iOS device, raising concerns regarding cross-platform persistence or serial-number-bound deployment (such as rogue Apple DEP).
• Interface Branding Anomaly: Crucially, despite these forced persistent lock states and active enterprise layers, the device interfaces display no corporate naming conventions, visible tenant branding, or enterprise email addresses. The managing entity remains entirely hidden on the UI level.
• Diagnostic Constraints: Due to a lack of low-level consumer diagnostic tools, it is unconfirmed if the persistence exists at the hardware/firmware or software/application level. Comprehensive digital forensics is required to isolate the vector.

Technical Requirements

To isolate the root cause (Hardware vs. Software), I require actionable input on the following:

• Crash Log Analysis: Automated tools or scripts to parse extensive iOS crash logs for anomalies, memory corruption, or unauthorized access.
• Advanced iOS Diagnostics: Frameworks (beyond standard MVT) to detect low-level system anomalies, configuration profiling, or firmware persistence.
• Forensic Triage: Recommended independent labs for consumer-level hardware and partition analysis.
• Keychain Access Group Corruption: Tools or workflows to diagnose the WhatsApp iCloud restore/Passkey failure WhatsApp iCloud backup restore fails, Pas… - Apple Community
• Administrative Constraints: Methods to diagnose why the official Apple Developer Program automated enrollment continuously rejects government-issued IDs despite multiple support escalations, preventing the activation of local Developer Mode diagnostics.

Clarify the technical reasons why device compromise during migration is impossible. For example, discuss protections like SimSwap prevention, IMEI binding (which Apple has deprecated), or the security of cloud-based transfers.