iShutdown scripts can help detect iOS spyware on your iPhone

Kaspersky published iShutdown Python scripts and a detection method that analyze iOS Shutdown.log (from sysdiagnose archives) to surface reboot delays and process paths indicative of high-profile spyware infections (Pegasus, Reign, Predator). The technique highlights processes delaying shutdown or originating from suspicious paths (e.g., /private/var/db/), can serve as a lightweight forensic artifact to support infection analysis, but requires the device to have been rebooted after compromise and some analyst familiarity with Python and iOS logs.