What Is Spyware? Surveillance Malware and Stalkerware

Most malware wants to take something and leave. Spyware wants to stay and watch. It is built to sit quietly on a device, observe what the person does, and stream that back to whoever planted it. The value is not a one-time theft. It is the ongoing view: what you type, where you go, who you talk to, and what you say.

That surveillance goal shapes everything about how spyware behaves. It has to stay hidden, because a target who knows they are watched changes their behaviour. And it has to persist, because the value grows the longer it observes.

What spyware collects

Spyware is a category rather than a single tool, and its reach depends on the device and the permissions it obtains. A capable sample can gather:

• Keystrokes, capturing passwords, messages, and searches as they are typed. This is the classic keylogger function.
• Screenshots and screen recording, seeing whatever the victim sees.
• Browsing and app activity, building a picture of habits and accounts.
• Location, tracking movement continuously through GPS or network data.
• Microphone and camera, turning the device into a live listening and viewing post.
• Messages, calls, and contacts, reading conversations across apps, sometimes including content from otherwise encrypted messengers once it is on the device.

On MITRE ATT&CK, these behaviours map to Input Capture (T1056), Screen Capture (T1113), and Audio Capture (T1123), among others. The common thread is observation of the user without their awareness.

Where spyware sits among its relatives

Spyware overlaps with several categories, and the labels blur. The distinctions that matter:

Type	Primary goal	Behaviour
Spyware	Ongoing surveillance	Watches and reports activity over time
Infostealer	Fast credential theft	Grabs saved data once and leaves
Keylogger	Capture keystrokes	One function, often part of spyware
Adware	Serve unwanted ads	Tracks to target ads, less covert
Stalkerware	Interpersonal monitoring	Consumer spyware, installed with access

An infostealer is a smash-and-grab; spyware is a stakeout. A keylogger is one capability that spyware usually includes. Adware tracks you to sell ads and is comparatively brazen about it. And stalkerware is the category where spyware stops being an abstract cybercrime problem and becomes a personal-safety one.

Stalkerware: spyware with a consumer front end

Stalkerware is spyware sold to ordinary people to monitor someone they know: a partner, a child, an employee. It is often marketed in softer language, parental control or employee monitoring, but technically it is the same surveillance capability wrapped in an app store listing and an easy installer.

Two things make stalkerware distinct from criminal spyware, and both change the defensive response.

First, it is usually installed by someone with physical access to the device and often knowledge of the passcode. This is not a remote exploit. It is a person picking up an unlocked phone and installing an app in a few minutes.

Second, the threat is interpersonal. The person being monitored may live with the person monitoring them, which turns detection and removal into a safety question rather than a purely technical one.

Signs of a spyware infection

Spyware works hard to stay hidden, but continuous surveillance has costs the device cannot fully mask. On a phone, watch for:

• Battery draining faster than usual, because constant tracking and uploading is work.
• Unexpected mobile-data or network usage, from streaming captured data out.
• The device running warm when idle, a sign of background activity.
• Unfamiliar apps or apps with generic names and icons you do not remember installing.
• Broad permissions, especially accessibility services, device-administrator rights, microphone, camera, and location granted to apps that should not need them.
• A jailbroken or rooted device you did not modify yourself, which many powerful spyware tools require.

None of these is proof on its own. Modern apps drain batteries and use data for legitimate reasons. The signal is a cluster of them appearing together, or appearing right after someone else had access to your device.

How to defend against spyware

1. Review app permissions regularly. On both iOS and Android, go through which apps hold access to your microphone, camera, location, and accessibility services. Revoke anything that has no business with them. Accessibility permission in particular is a common route for surveillance.
2. Keep the operating system and apps updated. Many spyware tools rely on known vulnerabilities. Patching closes the doors they walk through.
3. Install only from official app stores. Sideloaded apps and unofficial stores are a primary spyware delivery route. Stick to vetted sources.
4. Lock the physical device. A strong passcode and biometric lock is the single most effective barrier against stalkerware, which usually needs hands-on access to install.
5. Use reputable security software. Mobile security tools and, on desktop, established antivirus can flag known spyware and stalkerware families.
6. Audit after loss of physical control. If your device was out of your possession, or someone else knew your passcode, treat a full permission review and OS update as routine hygiene.

Spyware that watches is often paired with malware that steals what it sees, and the operators overlap. Our Threat Groups directory tracks the actors behind commercial surveillance tooling and the criminal groups that deploy spyware, so you can see who builds and buys these capabilities.

Spyware trades speed for patience. It gives up the quick theft in exchange for a long, quiet view. The defence is to deny it the two things it needs: the permissions that let it watch, and the physical or software access that lets it get installed in the first place.

How spyware gets onto a device

The surveillance is only possible once the software is installed, so the installation routes are where prevention has the most leverage. They fall into a few broad families.

The most common consumer route is a malicious or misleading app. Spyware is dressed up as something benign, a game, a utility, a system cleaner, a battery saver, and either sneaks past app-store review or, more often, arrives through sideloading from an unofficial store or a link. Once installed, it requests the permissions it needs and begins its work under an innocuous name and icon.

The second route is physical access, which is the defining path for stalkerware. Someone who can pick up an unlocked device, or who knows the passcode, can install a monitoring app in a few minutes. This route bypasses most technical defenses because it is not an exploit. It is an authorised installation performed by a person who has hands on the device, which is why a strong device lock is such an effective barrier against it.

The third route is exploitation of a vulnerability. More capable spyware, including commercial surveillance tooling, can use flaws in the operating system or in messaging apps to install with little or no interaction from the target. This route is less common against ordinary people and more associated with targeted operations, and it is the main reason keeping the operating system and apps fully updated matters, since patches close the doors these tools walk through.

The fourth route is deceptive configuration rather than a traditional app. On some platforms, granting a device-management or accessibility profile, installing a certificate, or linking an account can hand an outside party broad visibility without an obvious standalone app to find. Reviewing which profiles, device-admin apps, and linked accounts exist on a device is part of a thorough check.

A walkthrough of how surveillance works

Following the capability from permission to payoff shows why permission review is the highest-leverage defense. Take screen and input capture as the example. When an app is granted accessibility access, the operating system will report to it what is on the screen and what the user is doing, because that is the legitimate purpose of the feature: to let assistive tools read the interface aloud or act on the user's behalf. Spyware requests the same access and uses the same stream for the opposite purpose, quietly recording what the assistive channel was meant to narrate.

From there the collected data has to leave the device to be useful to whoever installed the tool, which is the step that produces the observable side effects. Streaming keystrokes, screenshots, or audio out consumes network data and battery, and doing it continuously in the background keeps the device working when it would otherwise be idle. This is why the classic signs of infection cluster around resource use: the surveillance is invisible, and the cost of exporting what it captures is not fully hideable.

The same shape holds for microphone, camera, and location. Each is gated behind a permission, each is silent when active, and each leaves a trail in battery, data, and heat because capturing and uploading are real work. Understanding this chain, permission to capture to export, explains both why revoking permissions is so effective and why watching for resource anomalies is a reasonable, if imperfect, detection strategy.

Detection signals in depth

The phone-focused signs listed earlier are the everyday indicators. A more thorough check adds several layers.

On the permission side, go beyond a quick glance and enumerate every app holding sensitive access: microphone, camera, location, contacts, messages, and especially accessibility and device-administrator rights. An app with a mismatch between what it is and what it can do, a wallpaper app with microphone access, a flashlight with location, is a strong signal. On both major mobile platforms there are indicators when the microphone or camera is active, and an indicator lighting up when no app should be using them is worth investigating.

On the resource side, the signal is a cluster rather than any single symptom. Fast battery drain, unexpected mobile-data usage, and the device running warm while idle each have innocent explanations alone, and appearing together, or appearing suddenly after someone else had access to the device, they point toward background surveillance. Reviewing per-app battery and data usage can localise which app is responsible.

On the configuration side, look for what does not belong: unfamiliar device-administrator apps, management or configuration profiles you did not install, certificates you do not recognise, and a device that has been rooted or jailbroken without your knowledge, since many powerful surveillance tools require it. On the account side, check for unrecognised sessions and linked devices, since some monitoring works by mirroring an account rather than installing a local app.

The absence of these signals is not proof of safety, because the most capable tools are built to minimise their footprint. The presence of several together is a strong reason to act.

Common misconceptions

Several widely held beliefs about spyware are wrong in ways that leave people exposed.

The first is that a passcode alone keeps everything out. A lock is genuinely the most effective barrier against the physical-installation route that stalkerware depends on, and it does nothing against spyware that arrives as a malicious app the user installs themselves or through an exploit. Device hygiene has to cover both the lock and what gets installed.

The second is that iPhones cannot get spyware. No mainstream platform is immune. The routes differ, and consumer stalkerware is more constrained on tightly controlled platforms, and capable surveillance tooling and account-mirroring approaches still reach them. Keeping the operating system updated and reviewing permissions and linked accounts matters regardless of platform.

The third is that antivirus catches all of it. Reputable mobile security tools flag known spyware and stalkerware families and are worth running, and the most advanced or bespoke tools may not match a known signature. Permission review and resource monitoring are defenses that do not depend on recognising a specific family.

The fourth is that stalkerware is a niche technical curiosity. It sits on the same technical foundation as criminal spyware, it is sold openly under softer labels, and the interpersonal context makes detection and removal a safety matter rather than a purely technical one. Treating it as just another malware category misses the part that most affects the person at risk.

How spyware compares to related threats

Placing spyware beside its neighbours clarifies what is distinctive about it. The categories overlap in practice, and the primary goal is what separates them.

Type	Primary goal	Persistence	Who typically deploys it
Spyware	Ongoing covert surveillance	Long-lived, stays hidden	Criminals, commercial vendors
Stalkerware	Interpersonal monitoring	Long-lived, hands-on install	An individual known to the target
Infostealer	Fast theft of stored secrets	Short, grabs and leaves	Financially motivated criminals
Keylogger	Capture keystrokes	Varies, often a component	Bundled inside broader tooling
Remote access trojan	Full remote control	Long-lived, interactive	Criminals and intrusion actors

Spyware and a remote access trojan both aim for durable presence, and the trojan is built for interactive control while spyware is built for passive observation, though a capable trojan can do everything spyware does. An infostealer is the opposite temperament, optimised for a single fast sweep of saved credentials. A keylogger is one capability that spyware and other tooling incorporate rather than a full category on its own. Stalkerware is spyware aimed at a person the operator knows, and that interpersonal framing, more than any technical difference, is what changes the response.

How spyware has evolved

The idea of software that watches its user is old, beginning with simple keyloggers and adware that tracked browsing to target advertising. As computing moved onto phones that carry a microphone, a camera, a location sensor, and a person's entire communication history, the value of surveillance software rose sharply, and the tooling grew to match. Modern spyware can reach far more of a person's life than its desktop ancestors, because the modern device holds far more.

Two developments shaped where things stand. One is the commercialisation of surveillance, where capable tooling is built and sold as a product, sometimes to states and sometimes more widely, raising the ceiling on what the most advanced spyware can do. The other is the mainstreaming of consumer stalkerware, sold openly under the language of parental control and employee monitoring, which put powerful surveillance capability within reach of ordinary individuals aiming it at people they know. Platform makers and security vendors have responded with clearer permission models, active-use indicators for the microphone and camera, and coordinated efforts to detect stalkerware, and the underlying tension remains: the same access that makes a device helpful is the access surveillance software wants.

Frequently asked questions

What is spyware? Spyware is malware built to secretly monitor a person or device and report the activity to whoever installed it. It can capture keystrokes, screens, location, microphone and camera, and the contents of messages, and its defining traits are surveillance and stealth.

How can I tell if my phone has spyware? Watch for a cluster of signs rather than any single one: fast battery drain, unexpected data usage, the device running warm when idle, unfamiliar apps, and broad permissions such as accessibility or device-administrator rights granted to apps that do not need them. Suspicion rises sharply if these appear right after someone else had access to your device.

What is the difference between spyware and stalkerware? Stalkerware is spyware with a consumer front end, sold to monitor a partner, child, or employee. It sits on the same technical foundation as criminal spyware, and it is usually installed by someone with physical access to the device, and the interpersonal context makes detection and removal a personal-safety matter.

Can spyware be installed remotely? Some can. The most capable tools can exploit vulnerabilities in the operating system or in apps to install with little interaction, which is why keeping software updated matters. Much consumer spyware and stalkerware, though, is installed by a person with physical access to the device.

How do I remove spyware? Review and revoke suspicious permissions, uninstall unfamiliar apps, and update the operating system. For deeper or persistent infections, a full backup-and-restore or factory reset followed by changing all important passwords from a separate trusted device is the reliable path. In an abusive situation, consider your safety before removing anything.

Does a factory reset remove spyware? For nearly all consumer spyware, yes, a factory reset removes it, provided you do not restore a backup that reintroduces the malicious app and you change your account passwords afterward from a clean device. Account-mirroring surveillance also requires revoking the unauthorised session or linked device.

How do I protect against spyware? Review app permissions regularly and revoke anything unjustified, keep the operating system and apps updated, install only from official app stores, use a strong device lock, run reputable security software, and treat any period when you lost physical control of the device as a reason to review permissions and update.

Is stalkerware legal? Selling monitoring software is often positioned as legal for permitted uses such as a parent monitoring a young child or an employer monitoring company-owned devices with consent. Installing it to secretly monitor another adult without their consent is unlawful in many places and is abusive regardless of local law. The technical capability is the same, and the legality turns on consent and ownership.

Can spyware read encrypted messages? Once spyware is on the device with sufficient permissions, it can often capture message content after it has been decrypted for display, since it reads what appears on screen or intercepts input directly. End-to-end encryption protects messages in transit between devices, and it does not protect a device that is already compromised at the endpoint. This is why endpoint hygiene matters as much as the encryption of the apps you rely on, since the strongest transport security is undone by a device that is watching the screen.

Related guides

• How to Detect Stalkerware
• What Is an Infostealer
• Phone Privacy Hardening
• What Is a RAT