Malware and Spyware Analysis
On this page3
Threat-intelligence and incident-response teams use Garbo to analyze suspicious mobile samples — from commodity malware to targeted spyware — on virtual iPhones that are isolated from corporate networks and from real users' devices. Analysis is carried out by authorized teams for defensive purposes.
How teams use Garbo
- Observe how a suspicious app or file behaves once it reaches a device, without putting physical hardware at risk.
- Turn what is observed into indicators of compromise and detection content for existing security tools.
- Check whether known indicators from public threat reports appear on a given iOS configuration.
- Keep a clean, reproducible baseline to compare against after every analysis run.
Typical workflow
- Isolate — create a dedicated virtual device for the investigation and snapshot its clean state.
- Observe — introduce the sample under controlled conditions and record the device's behavior.
- Extract — document the indicators and behaviors found and share them with detection and response teams.
- Reset — restore the clean snapshot before the next sample, so no residue carries over.
Why it matters
Analyzing hostile code on a real phone risks the device, the network around it and the data on it. A virtual, disposable device removes that risk while keeping the analysis realistic.