There have been weird things going on with all my electronic devices. They're the kinds of things that, if I were to bother describing them, you would tell me that it is not possible. However, and I am not kidding, every time I captured evidence on my device that would prove the occurrences, the proof would be edited in real time right from my iCloud account (or deleted with no trace of its existence). It may be because I'm involved in sensitive litigation or any other number of things, but I needed proof from outside my device (an external source of validity).

I worked for a while with Claude to try to develop a script to search my iPhone for signs of spyware (I am not a programmer, but it 'he' is a decent one). It would come back positive, but every time he would interpret the results for me, there would be a connection interruption and an API error, and then he would change course and deny the positive result as a false positive. He would then edit the script to soften those specific checks to the point I am not certain they did anything at all. The exact same thing would happen when I asked 'him' to analyze my pcaps. Yesterday, I purchased iMazing. It came back negative for spyware, but that was shortly after a reset.

Last night, I discovered the existence of the mvt tool and performed an 'mvt check-fs' on my iPhone..It came back positive for coruna.

❯ {
"level": "HIGH",
"module": "filesystem",
"message": "Found a known suspicious file name \"com.apple.photolibraryd.plist\" matching indicators from \"Coruna\"",
"event_time": "",
"event": {
"path": "Library/Containers/com.apple.photolibraryd/Data/Library/Preferences/com.apple.photolibraryd.plist",
"modified": "2026-09-12 08:15:19.644263"
},
"matched_indicator": {
"value": "com.apple.photolibraryd.plist",
"type": "file_names",
"name": "Coruna",
"stix2_file_name": "raw.githubusercontent.com_mvt-project_mvt-indicators_main_2026-03-03_coruna_cryptowaters_coruna.stix2"
}
}
]

In typical fashion, when I asked Claude to review the finding, he flags it as suspicious, and even identifies additional suspicious indicators--

"Two things stand out already — the file carries com.apple.quarantine and com.apple.macl extended attributes, which is unusual for a daemon's own preferences file. Let me read those and the contents."

--and then reverses course, such as: "Contents are unambiguously genuine Photos framework data, and the quarantine record names com.apple.cfprefsd as the writing agent. Let me confirm the false-positive mechanism and rule out a real artifact hiding elsewhere."

You get confused and frustrated, like when you have some medical issue but the doctors cannot identify it or its cause.

As another example of bizarre occurrences on another Apple device, I purchased a refurbished MacBook through Amazon last October. Within two months, it began exhibiting hardware issues. It would die to the point that the device did not even have enough energy to display the battery status indicator when attempting to start it, and it would start to recovery mode and warnings that the operating system needed to be reinstalled. The system time would drift from network (real) time. So, I returned it.

I opened back up my old MacBook, which I had replaced because I shorted half the keyboard while cleaning it. It had been wiped since its last use, so after months of being off, it opened to a fresh install. I have always used Proton VPN (or have since 2022), and when I went to install it, the Proton page included instructions to use a curl script to install it. I thought that was weird, but copied and pasted the command to terminal. Within seconds, XProtect grabbed it as running a malicious script. I'm not sure it was fast enough, however. I never saw that page with the curl script again. Proton VPN is downloaded as a dmg file from within your signed-in account. That was not the case that evening.

As anothjer example, on my computer(s), I have had and used Firewalla Gold Plus since 2022. Never had an issue with it. Suddenly, after I received veiled threats for using "firewalls and stuff", my app stopped pairing with it. It was the end of a short sequence of events which began with Firewalla no longer assigning IPv4 addresses to my devices, then assigning IP addresses outside the range of its subnet, and ended with the pairing issue. Long story short, and in the weirdest fashion, I have Firewalla on record spending four days lying to me about the cause, swearing that it is not the security dongle I just paid them $107 to replace, insisting that I open a remote console session, etc., when I used the serial console port and ran some commands to check the status of the HCI controller, the cause was without question, a defective security dongle. Firewalla has always had fantastic tech support. They literally lied to me for four days, trying to get me to open the Remote Support port on a network I repeatedly advised them was unsafe to open it (aside from the fact I couldn't open it without a paired device).

As another, I will suddenly get a warning that my memory is almost used up. Safari will be using 4-8 Gigs of RAM. That RAM will ostensibly be supporting the four tabs it has open, none of which run persistent programs that use high amounts of RAM. I'll look at my application layer firewall, Little Snitch, and it will have 1,000+ incoming connections. I'll copy the list and ask Claude to advise, "They're all benign, see a psychiatrist." Whether they're benign is a separate issue from the fact that it has never happened before, and ALF and Little Snitch both are set to deny all incoming connections by default. I shouldn't even be able to see these attempted connections in anything by the "denied" list (or not at all, since ALF doesn't have one). They’re requesting to connect with my devices around three firewall layers (one hardware, two application layers).

These weird things stack up and become oppressively heavy, and you just want affirmative answers.

I hoped this would help identify the issue with my iPhone so I could move forward with identifying the potential remedy.

How definitive is the ‘mvt-ios check-fs’ command?

If the file it identified shares its name with a genuine, Apple-published file, why would mvt recommend spending thousands of dollars on a forensic IT specialist based on name identification alone? Wouldn’t every iPhone in use have a false positive?