Modern spyware is written by people better at hiding than we are at seeking. Looking
for it by name is a race lost before it starts: names change every week. So Mythos
does something else — it looks for the traces that hiding forces
anyone to leave, because to do their job they have to move something.
Questions we already know the answer to
If you ask the phone something you already know, and it answers wrong, you have
learned something important: somebody is feeding it answers. You do not need to
find who is prompting — it is enough to notice the answer changed.
The chip cannot lie
Software controlling the heart of the phone can misrepresent everything that
passes in front of it. But inside every modern phone there is a separate chip that
signs its own answers, and nobody else can produce that signature. Mythos asks the
chip, and compares the two versions.
The reboot as bait
Today's spyware barely writes itself to disk: staying there means being found.
So a restart sweeps it away — and whoever put it there has to put it back. If
a trace disappears when you power off and returns hours later, it did not come
back on its own.
Who watches the watchman
Clever spyware does not just hide from whoever might find it: where it can, it
silences them. Kills the process, stops it working in the background, mutes its
notifications. Those moves are few and predictable — Mythos notices when it
is on the receiving end.
What we could NOT see
Every report has a section stating which doors the system kept shut to us during
that scan. It is not an excuse: it is the only thing that separates an analysis
from a reassurance. If you do not know what was not checked, "all clear" is worth
nothing.
A false alarm is a serious defect
People who use these tools are already frightened. A tool that cries wolf
teaches them to ignore it, and the day the wolf is real nobody turns around. On a
healthy phone Mythos must score zero, and every point above that we treat as our
own bug, to be found and explained.