How to Scan IPA Files for Malware Before Installing

ByScarlet iOS Team Updated on

Before you install an IPA file from outside the App Store, a few minutes of checking can save you from a modified app that steals logins, contacts or location data. This guide covers practical ways to check an IPA for malware, from a quick online scan to looking inside the file yourself, plus what to do if you already installed something suspicious. Last checked: October 27, 2026, against the VirusTotal and MobSF documentation and Apple’s iPhone User Guide for iOS 26.

The Risks First

  • No scan can prove an IPA is safe. Scanners find known threats; a new or well-hidden modification can pass every check.
  • Uploading a file to an online scanner shares it. VirusTotal’s docs say results are shared with its scanning partners, and that the files you submit can also be shared with its paying customers. Never upload an IPA that contains your own data or private builds.
  • The source matters more than the scan. A file from the developer’s own release page is far less risky than the same app re-uploaded by a stranger.

Quick Checklist

Check Time Needs What it catches
Source research 5 minutes A browser Fake sites, re-uploads, sources with bad reports
File hash 1 minute Terminal, a published hash Any change to the file after the publisher released it
VirusTotal A few minutes A browser Known malware that antivirus engines already detect
Look inside the IPA 10 minutes Unzip tool, ideally a Mac Extra libraries injected into the app
MobSF 15+ minutes Docker, or the online demo Risky permissions, trackers, hardcoded URLs and keys

Why IPA Files Can Be Dangerous

An IPA file is a ZIP archive that contains an iOS app. Anyone with the right tools can take a real app, add their own code to it, package it again and share it. The result looks and works like the original, but the added code can run in the background with whatever permissions you grant the app. This is called a repackaged or modified app, and it is the main way malware reaches iPhones outside the App Store.

Sideloading tools re-sign every app with a new certificate before installing it, so the signature on your iPhone tells you nothing about who made the app. That is why the checks below happen before you install.

Method 1: Research the Source

Do this first, because it is the only check that can catch something no scanner knows about yet.

  • Prefer the developer’s own release page, such as the app’s GitHub releases, over any mirror.
  • Search the exact file or source name on Reddit (r/sideloaded, r/jailbreak) for reports of problems.
  • Be wary of brand-new websites, anonymous file-hosting links and Telegram channels with no history.
  • Be very wary of sites offering paid apps for free. Those files have always been modified by someone, by definition.

Our list of IPA libraries and repositories covers what to look for in a source.

Method 2: Check the File Hash

Some developers publish a SHA-256 hash next to their download. A hash is a fingerprint of the file: if even one byte changes, the hash is completely different. If your file’s hash matches the published one, you have exactly the file the developer released.

  • Mac: open Terminal and run shasum -a 256 /path/to/app.ipa
  • Windows: open PowerShell and run Get-FileHash C:\path\to\app.ipa -Algorithm SHA256
  • Linux: run sha256sum /path/to/app.ipa

A match only helps if the hash comes from the developer, not from the same site that gave you the file. A hash on a mirror only proves the file is the one the mirror uploaded.

Method 3: Scan with VirusTotal

VirusTotal is a free service that checks a file against what its docs describe as more than 70 antivirus engines and URL and domain blocklists.

  1. Open virustotal.com on your computer.
  2. Choose File, select the IPA, and wait for the scan.
  3. Before uploading, paste the file’s SHA-256 hash into the Search tab. If someone already scanned the same file, you get the results without uploading anything.
  4. Read the detection names, not just the count.

How to read the result:

  • Several engines name the same malware family: do not install it.
  • One or two detections with generic names: could be a false positive. VirusTotal’s docs say it also helps you spot false positives: harmless files that one or more scanners flag as malicious. Check the community comments on the result and look at the source again.
  • No detections: means no engine knows it as malware. It does not mean the file is clean.

Method 4: Look Inside the IPA

Because an IPA is a ZIP file, you can open it without installing it.

  1. Copy the file and rename the copy from app.ipa to app.zip.
  2. Extract it. Inside is a Payload folder with an AppName.app folder in it (on a Mac, right-click it and choose Show Package Contents).
  3. Open Info.plist and check the bundle identifier and version. They should match the app you expect.
  4. Look in the Frameworks folder and the app folder for .dylib files. Injected code is usually added as an extra dylib with a name that has nothing to do with the app.

On a Mac with the Xcode command line tools, two commands go further:

  • otool -L Payload/AppName.app/AppName lists the libraries the app’s main program loads. A path to a library inside the app that is not one of its own frameworks is a red flag.
  • codesign -dv --verbose=4 Payload/AppName.app shows who signed the file. Compare it with the developer you expect, keeping in mind that many IPAs are distributed unsigned or re-signed.

Some modified apps, such as tweaked apps, are meant to contain extra dylibs. Then the question is not whether there is one, but whether you trust the person who added it.

Method 5: Deep Analysis with MobSF

Mobile Security Framework (MobSF) is a free, open-source tool. Its README says the static analyzer supports app binaries including IPA files, and it lists uses such as malware analysis and privacy analysis. A MobSF report on an IPA shows things like requested permissions, network addresses and strings found in the app.

  • Run it yourself: the README gives a Docker setup: docker pull opensecurity/mobile-security-framework-mobsf:latest, then docker run -it --rm -p 8000:8000 opensecurity/mobile-security-framework-mobsf:latest, and open localhost:8000 in a browser.
  • Online: the README links an online static analyzer at mobsf.live. The same privacy caution applies as with VirusTotal: you are uploading the file to someone else’s server.

Look for permissions the app should not need (a calculator asking for contacts), and network addresses that do not belong to the app’s developer.

If You Already Installed a Suspicious App

  1. Delete the app: touch and hold its icon, tap Remove App, then Delete App.
  2. Check Settings > General > VPN & Device Management and remove any profile you do not recognize.
  3. Review permissions in Settings > Privacy & Security, and check App Privacy Report there to see which domains apps contacted.
  4. Change the passwords of any accounts you signed in to inside that app, starting with your Apple Account and email.
  5. If you believe the compromise was serious, back up what you need and erase the iPhone in Settings > General > Transfer or Reset iPhone > Erase All Content and Settings.

Step-by-step paths for each permission are in our guide on how to revoke access from untrusted apps.

Good Habits

  • Get apps from the developer’s own release page whenever one exists.
  • Check the hash when it is published, and scan with VirusTotal every time.
  • Grant permissions only when an app needs them for what you use it for.
  • Use a separate Apple ID for sideloading if your tool asks for one, so the main account is never at risk.

For the bigger picture, see our iOS sideloading safety guide and what to know about enterprise certificates.

FAQ

Can I scan an IPA on my iPhone?

You can open virustotal.com in Safari and upload the file from the Files app. Looking inside the IPA and running MobSF need a computer.

Does the App Store’s review protect sideloaded apps?

No. A sideloaded IPA never went through App Review, even if the original app is on the App Store.

Is a clean VirusTotal result enough?

No. It only means no engine recognizes the file as known malware. Combine it with a trusted source and a look inside the file.

Similar Posts