https://cybertoolchain.io/tools/mobile-verification-toolkit New releases and features in Mobile Verification Toolkit, tracked by The Cyber Toolchain. en Mon, 26 Oct 2026 09:08:28 GMT https://github.com/mvt-project/mvt/releases/tag/v2026.10.26 https://github.com/mvt-project/mvt/releases/tag/v2026.10.26 Mon, 26 Oct 2026 09:08:28 GMT MVT v2026.10.26 adds Python 3.15 support.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds Python 3.15 support, extending the supported runtime range alongside Python 3.10–3.14.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Full history on Cyber Toolchain: https://cybertoolchain.io/tools/mobile-verification-toolkit https://github.com/mvt-project/mvt/releases/tag/v2026.9.28 https://github.com/mvt-project/mvt/releases/tag/v2026.9.28 Mon, 28 Sep 2026 09:07:02 GMT MVT's `check-bugreport` now descends into OEM wrapper archives and recovers previously truncated dumpstate sections⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Extends `check-bugreport` to descend into OEM wrapper `.zip` archives when the outer archive lacks a dumpstate entry point, automatically finding and using the nested bugreport.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Recovers properties lost when a section timing line was misidentified as a section boundary in bugreport parsing, restoring full `SYSTEM PROPERTIES` output on affected archives. • Surfaces accessibility service counts (`installedServiceCount=N`) per user in dumpsys accessibility analysis, raising a LOW alert when services are listed in the count but not named in the dump. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/mobile-verification-toolkit https://github.com/mvt-project/mvt/releases/tag/v2026.9.14 https://github.com/mvt-project/mvt/releases/tag/v2026.9.14 Mon, 14 Sep 2026 09:03:55 GMT MVT gains `--timezone`/`-t` for bugreport timestamp accuracy and defers IOC loading until first use.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `--timezone`/`-t` option to `mvt-android check-bugreport`, accepting an IANA timezone name (e.g.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ `Europe/Paris`), so bugreport file timestamps are interpreted in the device's wall-clock zone rather than the analysing machine's timezone; falls back to reading `persist.sys.timezone` from the bugreport's `SYSTEM PROPERTIES` section automatically. • Defers STIX indicator loading until first use, so `mvt-android` and `mvt-ios` subcommands that list modules or reject invalid paths no longer parse IOC files unnecessarily. • Reports unreadable or truncated sysdiagnose archives (catching `tarfile.ReadError`, `EOFError`, `zlib.error`, and `OSError`) with a critical-level log message and a clean exit code 1 instead of a silent `Aborted!`. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/mobile-verification-toolkit https://github.com/mvt-project/mvt/releases/tag/v2026.9.7 https://github.com/mvt-project/mvt/releases/tag/v2026.9.7 Mon, 07 Sep 2026 07:38:22 GMT MVT gains concurrent backup decryption with `--jobs`, a new `SysdiagnoseInfo` module, and fixes env-var leakage to `config.yaml`. • Adds `--jobs` option to `mvt-ios decrypt-backup` to control the number of concurrent decryption workers (integer, 1 to `MAX_DECRYPT_WORKERS`, defaults to `DEFAULT_DECRYPT_WORKERS`). • Adds a `SysdiagnoseInfo` module to `check-sysdiagnose`, extending IOC scanning to sysdiagnose archives. • Replaces the unmaintained `iOSbackup` dependency with `iphone_backup_decrypt` for iOS backup decryption, fixing decrypted-file truncation caused by inaccurate sizes in backup metadata. • Parses `dumpsys settings` output as per-record results in Android analysis, capturing multi-line values and metadata that per-line regex previously truncated or dropped. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/mobile-verification-toolkit https://github.com/mvt-project/mvt/releases/tag/v2026.9.1 https://github.com/mvt-project/mvt/releases/tag/v2026.9.1 Tue, 01 Sep 2026 17:43:18 GMT MVT gains a plugin system, a new `mvt` command, ADB key alerting, WhatsApp contacts module, and richer Android bugreport parsing • Adds a top-level `mvt` command (platform-neutral) hosting `version`, `completion`, `plugins`, and `download-iocs`; running `mvt` alone shows installed version, update notices, and available commands. • Adds `mvt completion` to generate shell completion scripts for Bash, Zsh, and Fish across `mvt`, `mvt-ios`, and `mvt-android`; pass the shell name (e.g. `mvt completion bash`) to emit the script directly, and `--install` to write it. • Adds a plugin system: third-party packages can register forensic modules and top-level CLI commands via Python entry points; `mvt plugins` lists installed plugins and checks for updates. • Adds `mvt.plugin` as a public Python import surface for writing plugin packages. • Allows custom modules to replace built-in MVT modules via the plugin system. • Modules with unavailable dependencies are now skipped instead of aborting the run. • Alerts on unexpected trusted ADB keys in AndroidQF acquisitions: raises LOW-severity alerts for malformed keys, keys from a different host, trusted keys when no acquisition host key is present, and informational alerts when the acquisition host key was last connected more than one day before collection. • Adds a WhatsApp contacts forensic module. • Preserves Android tombstone abort messages and protobuf `causes` lists in both text-parsed and protobuf-parsed analysis output. • Parses package installer attribution from Android bugreports. • Adds bugreport parsers for process tables, system settings, and mountinfo. • Parses system package flags, accessibility service states per user, ADB binary XML keys, AppOps UID and event details, battery history events, database operation details, multi-user package details, platform compatibility overrides, and multiline Android properties from bugreports. • Adds timezone provenance to file timestamps in analysis output. • AndroidQF runs no longer abort when encountering an encrypted `backup.ab`; the encrypted backup is skipped and analysis continues. • Builds and publishes Docker images for ARM64. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/mobile-verification-toolkit https://github.com/mvt-project/mvt/releases/tag/v2026.7.29 https://github.com/mvt-project/mvt/releases/tag/v2026.7.29 Wed, 29 Jul 2026 14:10:36 GMT MVT gains shell completion, custom module loading, iOS sysdiagnose checking, Safari profile scanning, and parallelized URL checks. • Adds shell completion command for Bash, Zsh, and Fish via `mvt-ios completion` and `mvt-android completion`. • Supports loading custom Python analysis modules with `--load-module PATH` or the `MVT_CUSTOM_MODULES` environment variable. • Adds iOS sysdiagnose checking support. • Scans Safari profile databases for browsing history and browser state. • Parallelizes URL indicator checks for faster IOC scanning. • Adds dependency-aware module execution, allowing modules to declare prerequisites and run in stable topological order. • Supports rotated iOS shutdown logs. • Matches Android receiver indicators by package ID. • Handles malformed AndroidQF backups gracefully instead of crashing. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/mobile-verification-toolkit https://github.com/mvt-project/mvt/releases/tag/v2026.5.12 https://github.com/mvt-project/mvt/releases/tag/v2026.5.12 Tue, 12 May 2026 16:28:58 GMT MVT v2026.5.12 adds checks for Android's new Intrusion Logging feature in Advanced Protection Mode. • Adds Android intrusion log checks, parsing Intrusion Logging data available in Android Advanced Protection Mode to surface forensic indicators. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/mobile-verification-toolkit https://github.com/mvt-project/mvt/releases/tag/v2026.4.28 https://github.com/mvt-project/mvt/releases/tag/v2026.4.28 Wed, 29 Apr 2026 12:37:50 GMT MVT v2026.4.28 overhauls alerting with multi-level alert system, adds AndroidQF bugreport analysis, and expands IoC and battery detection. • Replaces binary detected/not-detected alerting with a multi-level alert system, enabling heuristic detections and richer JSON output for downstream tooling. • Adds support for bugreport modules to analyse AndroidQF `dumpsys.txt` files. • Extends IoC matching to check broadcast receiver names. • Detects app uninstalls and downgrades via battery daily history analysis. • Aborts analysis and warns the user when an iOS backup is encrypted, preventing silent incomplete results. Breaking changes: • This release is described as a major v3 refactor; the README explicitly warns about v3 breaking changes — existing integrations that parse MVT JSON output or rely on the binary detected/not-detected alert structure will need to be updated for the new multi-level alert format. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/mobile-verification-toolkit https://github.com/mvt-project/mvt/releases/tag/v2.7.0 https://github.com/mvt-project/mvt/releases/tag/v2.7.0 Fri, 19 Dec 2025 12:55:32 GMT MVT v2.7.0 adds VirusTotal checks for androidqf, new mounts and root_binaries modules, and an option to disable update checks. • Extends VirusTotal checks to work with androidqf extractions in addition to ADB. • Adds `mounts` module for androidqf to inspect mounted filesystems on Android devices. • Adds `root_binaries` module for androidqf to detect root-related binaries on Android devices. • Adds options to disable automatic update checks. • Adds recognition of iPhone 16 and 17 models. • Updates known iOS versions to include iOS 18.6.1 and 18.6.2. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/mobile-verification-toolkit https://github.com/mvt-project/mvt/releases/tag/v2.6.1 https://github.com/mvt-project/mvt/releases/tag/v2.6.1 Fri, 19 Dec 2025 12:34:06 GMT MVT v2.6.1 adds Android tombstone file parsing, ADB keystore XML support, and new security warnings. • Adds parser for Android tombstone files, enabling analysis of crash/kill records during forensic investigations. • Adds support for parsing ADB keystore in XML format, expanding credential and key artifact coverage. • Loads Android device timezone info and logs additional file modification events for richer timeline analysis. • Adds additional Android security warnings to surface more suspicious indicators during device checks. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/mobile-verification-toolkit https://github.com/mvt-project/mvt/releases/tag/v2.6.0 https://github.com/mvt-project/mvt/releases/tag/v2.6.0 Mon, 27 Jan 2025 14:42:12 GMT MVT v2.6.0 adds IP indicator support, APK cert hash IOCs, new Android modules, and improved STIX2 directory scanning. • Adds support for IP address indicators in IOC matching across MVT checks. • Adds support for checking APK certificate hash IOCs to detect tampered or malicious Android packages. • New `packages` module for androidqf acquisitions to analyze installed package data. • New `files` module for androidqf acquisitions to inspect file listings. • New parser for ADB state within Dumpsys output to surface connected device info. • New module to parse uninstalled apps from Dumpsys data, surfacing historically present applications. • Adds additional heuristic detections for suspicious Android packages. • SQLite database recovery now attempted automatically when a DB is found locked or open. • STIX2 indicator loading via `MVT_STIX2` environment variable now recursively searches directories, not just individual files. • Improved STIX2 indicator support with broader indicator-type coverage and expanded test coverage. • Docker image now built with multistage builds and separate OS-specific images, reducing image size. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/mobile-verification-toolkit https://github.com/mvt-project/mvt/releases/tag/v2.5.1 https://github.com/mvt-project/mvt/releases/tag/v2.5.1 Thu, 11 Apr 2024 09:17:28 GMT MVT v2.5.1 shortens the VirusTotal flag to -V and reassigns USBmuxd debug to -v • Shortens the VirusTotal integration flag from `--virustotal` to `-V` for quicker CLI access. • Changes the usbmuxd debug option short flag from `-d` to `-v`. Breaking changes: • The VirusTotal integration is now triggered with `-V` instead of `--virustotal`; using the old long flag will fail. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/mobile-verification-toolkit