What Is Spyware? Signs, Removal, Prevention & Best Anti-Spyware Tools (2026)
Spyware is malware that watches you without permission. If your phone has been running hot, or someone seemed to know something private, it is natural to wonder whether you are being watched. Most odd device behavior has a harmless cause, and real spyware is fixable. This guide shows how to tell the difference, remove spyware safely on every major platform, and choose protection that independent tests support.
TL;DR
What it is: Spyware secretly collects data or monitors activity, from passwords and messages to location, microphone and camera access.
Signs: Battery drain, heat, odd data use, or unknown apps are clues, not proof. An unknown admin app or someone knowing private details is stronger evidence.
Safe response: If a partner or ex may be watching, plan for safety first, use a trusted device, and keep evidence before removing anything.
Removal: Update, scan with built-in tools, remove unknown apps and permissions, then change passwords from a clean device.
Tools: Built-in protection is a strong base. Independent tests help you choose extra software, but no tool catches everything.
What is spyware? (Quick Answer)
Spyware is software that secretly monitors a device and collects information such as passwords, messages, location, or browsing activity without the owner's informed consent. It can enable fraud, identity theft, or stalking. The first defensive priority is to update the device, run trusted security scans, and put personal safety first if abuse is suspected.
Table of Contents
What Is Spyware?
Spyware is software that secretly watches what you do and passes that information to someone else. It can record keystrokes, copy messages, track location, capture screens, or switch on a microphone or camera. The key word is secretly: the device owner has not knowingly agreed. The FTC uses the terms stalkerware and spyware for programs that someone installs on your phone or other device without your knowledge (FTC stalkerware guidance).
Spyware is one type of malware, alongside a computer virus, a computer worm, and ransomware. The difference is purpose. A virus spreads, ransomware locks files for payment, and spyware stays quiet so it can keep collecting.
What spyware includes, and what it does not
Tracking cookies and ad trackers collect browsing data, but they normally work inside a browser under a site's privacy terms. They are a privacy concern, not the same as software that takes over a device. Legitimate monitoring also exists: employers manage work laptops, and parents may use age-appropriate controls, as discussed in our guide to Roblox safety for kids. Monitoring becomes spyware when it is hidden, unauthorized, or used to control or harm someone.
A documented example
The FTC explains that an abusive partner or ex-partner can use an app to track location, record calls, read messages and emails, and see photos and online activity. Some of these apps hide behind innocent names such as “System Service.” That is why the warning signs later in this guide matter, and why safety comes before removal.
How Does Spyware Work?
Most spyware follows the same defensive lifecycle. Knowing it explains why some infections stay quiet and why a single scan can miss them.
Entry. The software arrives through a phishing message, a risky download, a deceptive app, an unsafe browser extension, or someone with physical access to the device.
Permissions and execution. It asks for access, or abuses features such as accessibility services or device administration, so it can see far more than a normal app.
Monitoring. It records activity such as keystrokes, screens, messages, location, or microphone and camera input. MITRE ATT&CK lists keylogging under Input Capture and notes that the technique is hard to stop with preventive controls alone because it abuses normal system features.
Persistence. Some spyware restarts with the device, hides its icon, or uses a harmless-looking name so it survives casual cleanup.
Collection and transfer. The data is stored and then sent to a remote server or to the person doing the monitoring.
Detection is hard for three reasons. The FTC notes that these apps are designed to avoid the owner's notice. Some run without a visible icon. And monitoring software sold as a “parental” or “employee” product may not be labeled malware by every tool. A clean scan therefore lowers risk but does not prove safety. This guide stays at the defensive level and does not explain how to build or hide surveillance software.
Types of Spyware
Spyware labels overlap. Some describe what the software does, and others describe who uses it, so one tool can fit more than one label.
Common categories
Keyloggers record what you type, which can expose passwords and private messages.
Infostealers collect saved passwords, browser sessions, and files, often in one quick sweep.
Banking threats target online banking sessions and card details, often through fake login pages.
Browser spyware abuses extensions or hijacked settings to read pages, change searches, or log browsing history.
Mobile surveillance apps and stalkerware monitor location, messages, calls, and photos on phones and tablets.
Trojan-based spyware hides inside a program that looks useful, so you install it yourself.
Targeted commercial surveillance is rare and aimed at a small number of high-risk people. Apple says most people are never targeted by attacks of this kind (Apple Lockdown Mode guidance).
Type, risk, and first defense
Type | Main risk | First defense |
|---|---|---|
Keylogger | Stolen passwords and messages | Updates, MFA, trusted security scan |
Infostealer | Stolen saved logins and sessions | No pirated software, password manager, MFA |
Stalkerware | Location and message monitoring | Safety plan first, then app and permission review |
Targeted surveillance | Deep access for chosen targets | Updates, Lockdown Mode where suitable, specialist help |
Not every tracker is spyware. Advertising trackers and cookies raise privacy issues but do not usually take control of a device, so review browser privacy settings before assuming an infection. Attackers are also using automation to make threats harder to spot, which we cover in our guide to AI malware.
How Does Spyware Get on a Device?
Spyware needs a way in. Most routes depend on human trust or weak settings, not movie-style hacking.
Phishing and [social engineering](@social-engineering). A message pushes you to open an attachment, install an “update,” or sign in on a fake page. The FTC warns that fake security warnings and bogus software ads are common malware routes (FTC malware guidance).
Bundled or deceptive software. Free tools, cracked programs, and fake “cleaners” can carry spyware beside the feature you wanted.
Unsafe browser extensions. An extension with broad page access can read what you see and type.
Permission abuse. On phones, an app can ask for accessibility, notification, or device-admin access and then monitor far more than it should.
Unpatched vulnerabilities. Old system versions leave known holes open. See our platform guides to Windows, macOS, Android, and iOS.
Physical access. Someone who knows your passcode can install monitoring software in minutes.
Compromised accounts. Not every case is a device infection. Someone with your Apple Account, Google Account, or email password may read data from the cloud without any app on your phone.
Platform differences
Windows has long been a frequent malware target because of its size and the variety of software it runs. macOS adds Gatekeeper, Notarization, and XProtect layers (Apple Platform Security), yet users can still be tricked into approving harmful software. Android allows apps from outside the official store, a common stalkerware path. iPhone apps are sandboxed, so many iPhone problems come from account access, sharing settings, or management profiles rather than classic malware. The operating system matters, but user choices matter more.
12 Warning Signs of Spyware
No single sign proves spyware. Most of these clues have ordinary causes, such as an aging battery, a large app update, or a busy background sync. Treat each one as a reason to check, not a reason to panic. Signs that involve account access or someone knowing private details are stronger than performance changes.
Weaker clues: performance and behavior
Fast battery drain. Constant background activity uses power, but so do old batteries and heavy apps.
Heat while idle. A phone that is hot while untouched may be running something unusual, or may simply be updating.
Unexpected data use. Monitoring tools send data out. Check which apps use data before drawing conclusions.
Slowdowns, freezes, or crashes. The FTC lists these among common malware symptoms (FTC malware guidance), but low storage and old hardware cause them too.
Browser changes. A new home page, redirects, unfamiliar toolbars, or heavy pop-ups can point to unwanted software or a bad extension.
Unexpected restarts. The FTC's stalkerware guidance asks whether a phone turns off and on by itself.
Stronger clues: access, permissions, and knowledge
Unknown apps or hidden icons. Look for names such as “System Service,” “Device Health,” or “Accessibility” that you did not install.
Odd permissions. Accessibility, notification access, device administrator, or “display over other apps” granted to an app that has no need for them deserves attention.
Microphone or camera indicators. An unexpected indicator light or access notice should be traced to the app responsible.
Unknown sessions or account changes. Logins from unfamiliar devices, changed recovery details, or password resets you did not request point to account compromise.
Disabled protection. Security tools that switch off by themselves, or system tools such as Task Manager that stop opening, are red flags the FTC lists for malware.
Someone knows private details. If another person knows your location, messages, or searches without a fair explanation, treat it as a serious signal (FTC stalkerware guidance).
Two or more strong clues justify moving to the safety steps below. A strong clue in a relationship involving control or abuse justifies moving there at once. A work device with strong clues belongs with your security team. For wider context, see our guides to cyberattacks and threat actors.
How to Check for Spyware
Check in a calm, ordered way and write down what you find. If abuse is possible, read the next section before you change anything.
Separate the clues. List what you noticed and when it began. Keep performance problems apart from account signs.
Check accounts from a trusted device. Review recent logins, connected devices, recovery email and phone numbers, and mail forwarding rules.
Review apps and extensions. Sort by install date and look for anything you do not recognize.
Review permissions. Look for accessibility, device admin, notification access, location, microphone, and camera access you did not grant knowingly.
Check for management profiles. A work or school device may legitimately have one. An unexpected profile on a personal device is a concern.
Install updates. Operating system and app updates close known flaws.
Run built-in protection. Use Windows Security, Google Play Protect, or the macOS protections described below, alongside any endpoint protection you already use.
Escalate when clues remain. If signs persist, or you suspect targeted surveillance, ask a qualified specialist.
A clean scan is not proof of safety
Security tools mainly recognize known malware and suspicious behavior. Monitoring apps sold as legal products, new variants, and targeted tools can slip past, so a clean result is good news rather than a guarantee. Expect false positives too: a legitimate remote-support or parental-control app may be flagged, so confirm who installed it before deleting. Use trusted sources only. The FTC warns against clicking ads to download software and against calling phone numbers shown in pop-ups, both of which are common scam routes. For behavior-based detection in larger environments, see anomaly detection.
Before You Remove Spyware: Safety and Evidence
If someone close to you may be monitoring your phone, removal can alert them. The FTC says an abuser who uses stalkerware may escalate if they suspect you are cutting off access, and it advises reaching out to a domestic violence advocate before removing anything (FTC stalkerware guidance).
If a partner or ex may be monitoring you
Use a different device for research and calls, such as a friend's phone or a pay-as-you-go phone. Searching for help on the suspect phone can tip off the person monitoring it.
In the United States, the National Domestic Violence Hotline offers help at 1-800-799-7233, live chat at thehotline.org, or text START to 88788. Elsewhere, look for a local domestic violence or victim-support service. Advocates can help with a safety plan and with preserving evidence.
Do not confront the person you suspect.
Consider waiting to remove the software until you have a plan.
Preserve evidence first
Before a reset or replacement, document what you can. Screenshots of unknown apps, account login lists, and strange messages may matter later. Apple's Personal Safety User Guide also covers gathering evidence and describes how to restore a device to factory settings.
For everyone else
Pause sensitive logins such as banking on the suspect device. The FTC advises stopping logins to online accounts after suspected malware.
Change passwords for important accounts from a trusted device.
Back up photos and documents you trust, but not apps, because a backup can bring spyware back.
Isolate a suspect computer from the network only if you do not need evidence from it.
If this is a company device
Stop and contact your security team. Do not wipe the device before they decide what must be preserved. Investigation belongs to incident response and forensic specialists, a field we explain in our guide to threat detection and response.
How to Remove Spyware From Windows
Windows includes Microsoft Defender Antivirus through the Windows Security app, which is the right place to start. The steps below match current Windows 10 and Windows 11 menus, though labels can shift between versions.
Decide about evidence. On a work PC, stop and call your security team first. On a personal PC, copy photos and documents (not programs) to a trusted drive.
Update Windows. Install pending updates so Defender has current protection.
Run a full scan. Open Windows Security, choose Virus & threat protection, select Scan options, pick Full scan, then select Scan now.
Run Microsoft Defender Offline. In Scan options, choose Microsoft Defender Offline scan and select Scan now. Save your work first: the PC restarts and the scan runs outside the normal Windows environment, taking about 15 minutes. Microsoft says it targets malware that hides from normal scans, such as rootkits. If BitLocker is on, suspend it first or you may be asked for a recovery key. The scan needs Windows Recovery Environment enabled and does not apply to ARM-based PCs (Microsoft Learn, updated 2026-07-03).
Read Protection history. In Scan options, open Protection history to see what was found and what action was taken.
Remove unknown software. In Settings, open Apps and uninstall programs you did not install. In each browser, remove unfamiliar extensions and reset the home page and search engine.
Secure accounts. From a different, trusted device, change important passwords and turn on multifactor authentication.
Do not switch off Defender or install several real-time antivirus programs side by side, because they can conflict. A reputable on-demand scanner can give a second opinion, but download it only from the vendor's official site, never from an ad.
When to rebuild or call a professional
If symptoms return, protection keeps turning itself off, or you cannot trust the machine, back up personal files, reinstall Windows from official media, and restore files only. Malware that reaches the system core, as explained in our kernel guide, is a common reason to rebuild instead of clean. Business laptops should go through IT.
How to Remove Spyware From a Mac
Apple describes macOS malware defenses in three layers: App Store or Gatekeeper with Notarization to prevent launch, XProtect to block, and XProtect again to remediate. Apple updates XProtect signatures automatically (Apple Platform Security).
Update macOS. Install pending updates from System Settings.
Review Applications. Sort by date added and move apps you did not install to the Trash.
Check login items. In System Settings, open General and review Login Items and Extensions. Remove entries you do not recognize.
Review privacy permissions. In Privacy & Security, check Accessibility, Input Monitoring, Screen Recording, Full Disk Access, Camera, and Microphone for unfamiliar apps.
Check profiles and browser extensions. Look in System Settings for configuration profiles or device management you did not set up, and remove unfamiliar browser extensions.
Get a second opinion if needed. A reputable Mac security tool can help; run only one real-time product.
Secure accounts. Review your Apple Account's devices and change passwords from a clean device.
If problems persist, back up personal files, erase the Mac, and reinstall macOS. Do not restore apps from a suspect backup. For the rare person at high risk of targeted attacks, Apple offers Lockdown Mode on Mac, which strictly limits features to reduce the attack surface (Apple).
How to Remove Spyware From Android
If you suspect a partner or ex, finish the safety steps above first. Then start with Google Play Protect, which checks apps from Google Play and other sources, may warn you about harmful apps, and may disable or remove them. It is on by default, and Google recommends keeping it on (Google Play Help). Menu names vary by manufacturer.
Run a Play Protect scan. In the Play Store app, tap your profile icon, choose Play Protect, and scan. Confirm that Scan apps with Play Protect is on.
Update Android and your apps. Install pending system and app updates.
Check accessibility services. In Settings, open Accessibility and review downloaded services. TechCrunch reports that stalkerware often abuses accessibility features and uses names such as “Device Health” (TechCrunch, 2025-02-20).
Check device admin apps. In the security settings, open Device admin apps. Most personal phones have none, so an unfamiliar entry is a strong warning.
Review notification access and unknown-app installs. Revoke both for apps you do not recognize.
Remove the suspect app. Turn off any admin rights first, then uninstall it from the app list.
Secure your Google Account. Review signed-in devices, change the password from a clean device, and enable multifactor authentication.
When a factory reset helps
The FTC says a full factory reset may remove stalkerware, and that the safest option may be a new phone with an account the abuser cannot reach. Document evidence first. Some stalkerware needs a “rooted” phone, and the Safety Net Project of the National Network to End Domestic Violence offers a guide to checking this. After a reset, do not reinstall apps from a backup of the old phone, because that can bring the problem back. Download them again from the app store (FTC stalkerware guidance).
How to Remove Spyware From an iPhone or iPad
Because of iOS sandboxing, ordinary apps cannot scan other apps or the whole system the way a Windows tool can, so be wary of iPhone “antivirus” claims. Most iPhone privacy problems come from shared access, a compromised account, or an unwanted management profile, not from classic malware. Keep those cases separate: sharing your location through Find My is not an infection.
Update iOS or iPadOS. Install the latest version in Settings.
Run Safety Check. Go to Settings, Privacy & Security, Safety Check. It needs iOS 16 or later and an Apple Account that uses two-factor authentication. Manage Sharing & Access lets you review people and apps, and Emergency Reset stops all sharing at once. Quick Exit closes the screen fast. Safety Check cannot review non-Apple accounts, social media sharing, or devices signed in to a different Apple Account, and it is not a spyware scanner (Apple Safety Check).
Review devices on your Apple Account. Open Settings, tap your name, and remove devices you do not recognize.
Check profiles and device management. In Settings, General, look for VPN & Device Management. Work or school profiles can be legitimate; an unknown profile on a personal device is not.
Review app permissions. In Privacy & Security, check location, microphone, camera, and photo access.
Secure the account. Change your Apple Account password from a clean device and review your trusted phone numbers.
Reset and high-risk cases
Apple's personal safety guide says that restoring a device to factory settings erases information and settings, including apps installed without your knowledge (Apple Personal Safety User Guide). Set the device up as new and avoid restoring from a backup you do not trust. If you may face highly sophisticated, targeted attacks, Lockdown Mode is an extreme, optional protection that blocks installation of configuration profiles while it is on, though Apple stresses that most people are never targeted (Apple). Targeted-attack concerns call for specialist help.
What to Do After Spyware Removal
Removal cleans the device. Recovery covers everything the spyware may have seen.
Change credentials from a trusted device. Start with email, then banking, Apple or Google accounts, and social media.
Revoke sessions and tokens. Sign out of all devices and remove unknown connected devices and app authorizations. Stolen session tokens can keep an account open even after a password change.
Check recovery methods. Remove unknown recovery emails, phone numbers, and mail forwarding rules.
Turn on multifactor authentication or passkeys. The FTC recommends two-factor authentication (FTC malware guidance).
Consider financial and identity monitoring. If banking or identity details may have leaked, contact your bank. The FTC points US readers to IdentityTheft.gov for a recovery plan.
Restore carefully. Bring back photos and documents, and reinstall apps from the official store rather than a backup.
Watch for recurrence. Recheck permissions and login history after a week. If signs return, ask a specialist.
Remediation can reach beyond the device. Keep clean, dated copies of important files, as discussed in our guide to backup as a service, and keep any evidence you may need later.
Best Anti-Spyware Tools: Evidence-Based Picks
This is an editorial reading of public evidence, not proprietary laboratory testing, and nothing here is ranked or personally tested. The main evidence comes from AV-TEST, which tested 15 home-user products on Windows 11 in July and August 2026 (AV-TEST, August 2026) and 14 Android products in September 2026 (AV-TEST, September 2026). Products can earn up to 6 points each for protection, performance, and usability, and Windows products with 17.5 points or more earn Top Product. These scores measure general malware protection. They are not direct proof that a product finds stalkerware or sophisticated spyware.
Microsoft Defender Antivirus
Best for: a free, built-in Windows baseline. In the August 2026 test, Defender scored 6 for protection, 5.5 for performance, and 6 for usability, and earned Top Product. It includes the offline scan described above. Limits: it covers Windows only, and the lab results do not address stalkerware. Official page: Microsoft Windows security.
Bitdefender
Best for: a paid suite across Windows and Android. Bitdefender Total Security 27.0 scored 6, 6, and 6 on Windows, and Bitdefender Mobile Security 3.3 scored 6, 6, and 6 on Android. AV-TEST also gave its 2025 Best Protection award for consumer users to Bitdefender Total Security (AV-TEST Awards 2025). Limits: it is paid, and plan features and renewal prices vary, so check the vendor's page. Official site: Bitdefender.
Norton 360
Best for: a broad paid suite with Windows and Android coverage. Norton 360 scored 6, 6, and 6 in both the August 2026 Windows test and the September 2026 Android test. Limits: extras may exceed what a casual user needs, and renewal terms vary. Official site: Norton.
ESET Security Ultimate
Best for: Windows users who want a paid suite with top lab scores. ESET Security Ultimate scored 6, 6, and 6 and earned Top Product in August 2026. Limits: it did not appear in AV-TEST's September 2026 Android list, so this article makes no Android claim. Official site: ESET.
Malwarebytes Premium
Best for: Windows users who want an alternative to a full suite. Malwarebytes Premium scored 6, 6, and 6 and earned Top Product in August 2026. Limits: AV-TEST tested the Premium edition, and Malwarebytes was not in the September 2026 Android list. Check the vendor's page for free options and current plans. Official site: Malwarebytes.
Google Play Protect
Best for: a built-in Android baseline. Google Play Protect 53.0 was certified in September 2026 with 5.5 for protection, 6 for performance, and 6 for usability, slightly below several paid apps on protection. It scans apps from Google Play and other sources and may remove harmful ones (Google Play Help). Limits: a scan does not replace a safety plan when stalkerware is possible.
Apple built-in safeguards
Best for: iPhone, iPad, and Mac baselines. Apple provides Safety Check for sharing and access, Lockdown Mode for rare high-risk users, and Gatekeeper, Notarization, and XProtect on Mac. Limits: Safety Check is not a spyware scanner, and third-party iOS apps cannot scan the whole system (Apple Safety Check).
Anti-Spyware Tools Comparison Table
Tool | Best for | Platforms tested | Free or paid | Major strength | Main limitation |
|---|---|---|---|---|---|
Microsoft Defender Antivirus | Free Windows baseline | Windows | Built in | Top Product, Aug 2026 (6 / 5.5 / 6) | Windows only; no stalkerware claim |
Bitdefender | Paid multi-device suite | Windows, Android | Paid | 6 / 6 / 6 on both tests | Plans and renewal prices vary |
Norton 360 | Broad suite | Windows, Android | Paid | 6 / 6 / 6 on both tests | Extras may exceed needs |
ESET Security Ultimate | Windows suite | Windows | Paid | 6 / 6 / 6, Top Product | Not in Sept 2026 Android list |
Malwarebytes Premium | Windows alternative | Windows | Paid edition tested | 6 / 6 / 6, Top Product | Not in Sept 2026 Android list |
Google Play Protect | Android baseline | Android | Built in | Certified (5.5 / 6 / 6) | Lower protection score than top suites |
Apple built-in safeguards | iPhone, iPad, Mac baseline | iOS, iPadOS, macOS | Built in | Safety Check, Lockdown Mode, XProtect | Not a spyware scanner |
Scores read protection, performance, and usability out of 6 and come from the AV-TEST tests above. No tool can guarantee complete protection.
How to Choose an Anti-Spyware Tool
Start with your situation, then check the evidence.
Threat model. For everyday malware, updates plus built-in tools are a strong start. For suspected stalkerware, a safety plan and specialist advice outrank any app. For targeted attacks, seek expert help.
Operating system limits. iOS restricts third-party scanning, so favor Apple's own safeguards there.
Independent evidence. Look at recent AV-TEST or AV-Comparatives results and read what each test measures.
Removal and real-time protection. Check that the product both blocks and cleans, and run only one real-time product.
False positives and performance. A tool that flags safe apps or slows your device will be switched off.
Privacy. Security software sees a lot. Read the privacy policy before installing.
Support and cost. Compare renewal prices, refund terms, and the number of devices covered.
Home or business. Organizations need managed AI endpoint protection and a wider toolset, such as the options in our guide to AI cybersecurity tools.
When built-in protection is enough
For most people with updated devices, careful installs, and multifactor authentication, Defender, Play Protect, and Apple's safeguards are a sound base. A paid suite makes sense if you want multi-device management, extra web protection, or vendor support. Before adding anything, confirm it will not conflict with your current real-time protection.
How to Prevent Spyware
Put the measures that cut the most risk first.
Patch quickly. Turn on automatic updates for the operating system, browser, and apps. The FTC advises regular updates because they carry critical patches (FTC stalkerware guidance).
Install from trusted sources. Use official app stores and vendor sites. Avoid cracked software and ad-led downloads (FTC malware guidance).
Trim permissions and extensions. Review accessibility, device admin, and notification access every few months, and delete extensions you do not use.
Lock your devices. Use an automatic screen lock and a passcode of at least six digits, change it if someone knows it, and keep physical control of your phone.
Use multifactor authentication or passkeys, plus a password manager. Then a stolen password alone does far less harm.
Learn to spot phishing. Do not click links in unexpected messages. Contact the company through a number you know is real. Teams can practice with the tools covered in our guide to phishing simulation software.
Keep clean backups. Back up files so a rebuild costs you little.
Review sharing. Check shared accounts, family sharing, and location sharing from time to time.
Add protection that fits. Pair built-in or paid endpoint protection with a firewall and sound network security.
Apply least privilege. Give people only the access they need, and keep administrator accounts separate.
These habits do more than any single product, because most spyware depends on a lapse in one of them.
Spyware Risks for Businesses and SaaS Teams
Spyware on an employee's laptop is rarely only a laptop problem. Stolen passwords and session tokens can open email, cloud tools, customer portals, and APIs. The data at risk includes customer records, source code, and contracts, and the cost includes lost customer trust.
How the risk travels
Endpoint to account. An infected device can expose saved logins and active sessions.
Account to cloud. A stolen token may reach storage buckets and admin consoles, which makes cloud security basics essential.
Application and API exposure. Weak access checks in a web application, an API, or a SaaS product can let a valid login reach more than it should.
Detection gaps. Without logging and alerts, misuse can go unnoticed.
Controls that work together
Endpoint protection and device management on every work device.
Multifactor authentication, short session lifetimes, and least-privilege access.
Logging and monitoring, such as SIEM, and data loss prevention where it fits.
A written response plan that names who preserves evidence.
Regular, authorized application and API assessments.
Compliance context, such as NIS2, where your sector requires it.
When a scoped penetration test helps, and when it does not
A penetration test is an authorized, scoped, point-in-time assessment. It helps when you need to know whether authentication, authorization, session handling, and API controls hold up before a launch, before a customer security review, or after fixes. Articsledge's service page describes assessments of web applications, APIs, and SaaS products, plus vulnerability assessment and remediation retesting, all subject to agreed scope, qualified specialist availability, commercial terms, and written authorization. Our guide to penetration testing services explains types, process, and costs.
It does not remove spyware from a device, preserve forensic evidence, run incident response, replace endpoint protection, or guarantee that every flaw is found.
When Should You Seek Professional Help?
Seek help sooner rather than later in these cases.
You may be under surveillance by a partner, ex-partner, or controlling person.
Symptoms persist after you cleaned and reset the device.
Financial or organizational accounts may be exposed.
You may face a complex or targeted attack.
Evidence may be lost, or legal action is possible.
A business device or account is involved.
Which specialist fits
Personal safety support: domestic violence advocates and technology-safety programs for stalking and abuse concerns.
Qualified device or forensic responder: for evidence-grade examination of a device.
Endpoint or incident-response provider: for company infections and breaches.
Penetration tester: for authorized assessment of applications and APIs, not for cleaning devices or personal safety problems.
Do not send a personal safety case to a business security service. If you are unsure, start with the support closest to the problem and ask for a referral. Teams building a program can begin with our overview of cybersecurity.
Frequently Asked Questions
What is spyware in simple terms?
Spyware is software that secretly watches what you do on a device and sends the information to someone else. It may log keystrokes, copy messages, track location, or use the microphone and camera. It is a type of malware built to stay hidden while it collects.
How can you tell if spyware is on your phone?
Look for unknown apps, strange permissions such as accessibility or device admin, and unusual battery, heat, or data use. None of these proves it alone, so check account logins too. If a partner or ex may be monitoring you, put safety first and use another device for research.
What are the most common signs of spyware?
Common signs include fast battery drain, heat, high data use, slowdowns, unexpected restarts, browser changes, unknown apps, odd permissions, unfamiliar account sessions, disabled security tools, and someone knowing private details. Performance clues are weak. Account and permission clues are stronger.
Can spyware steal passwords?
Yes. Keyloggers and infostealers are built to capture passwords, saved logins, and session data. After removal, change passwords from a clean device, revoke sessions, and turn on multifactor authentication so that a stolen password alone is less useful.
Can spyware access a camera or microphone?
Some spyware can, usually by abusing permissions it was granted. Devices show indicators or access notices, so check which apps hold camera and microphone permission and remove any you do not recognize. An unexplained indicator deserves a closer look, but it is not proof by itself.
Can an iPhone get spyware?
It is possible but uncommon. iOS sandboxing limits what apps can do, and most iPhone problems involve shared access, compromised accounts, or unwanted management profiles. Targeted attacks exist. Apple offers Lockdown Mode for rare high-risk users and says most people are never targeted.
Can Android phones have spyware?
Yes. Android allows apps from outside the official store, and stalkerware often abuses accessibility or device-admin permissions. Google Play Protect scans apps and may remove harmful ones, and you can review accessibility services and device admin apps in your settings.
Does a factory reset remove spyware?
The FTC says a full factory reset may remove stalkerware, but it is not a guarantee. A reset also erases data and may destroy evidence, so document first. It does not fix a compromised account. Afterward, reinstall apps from the app store, not from an old backup.
Is spyware the same as a virus?
No. A computer virus spreads by infecting files or programs. Spyware is malware whose job is to watch and collect information. Both are kinds of malware, but spyware tries to stay hidden rather than spread or cause visible damage.
Can antivirus software detect spyware?
Sometimes. Security tools detect known malware and suspicious behavior, and newer ones add behavior analysis, as described in our guide to AI threat detection. Monitoring apps sold as legitimate products and targeted tools can still slip past. AV-TEST scores measure general malware protection, not stalkerware detection, and a clean scan is not proof of safety.
What is the difference between spyware and stalkerware?
Stalkerware is spyware used to monitor a specific person, often a partner or ex-partner, without consent. The FTC treats the terms as overlapping. The difference is context and risk: stalkerware cases involve personal safety, so safety planning comes before removal.
What is the best free anti-spyware tool?
Microsoft Defender on Windows, Google Play Protect on Android, and Apple's built-in safeguards on iPhone and Mac are free baselines that come with those platforms. For extra scanning, check each vendor's current free options and use only official download pages.
Is spyware illegal?
Often yes, but laws differ by country and situation. Secretly installing monitoring software on another adult's device is unlawful in many places. Employer monitoring of work devices and parental controls can be lawful when disclosed and proportionate. This is general information, not legal advice, so ask a qualified lawyer.
What should a business do after suspected spyware exposure?
Isolate the device, call your security team or an incident-response provider, and preserve evidence before wiping anything. Reset credentials, revoke sessions, review access logs, and assess what data was exposed. Afterward, review your cybersecurity infrastructure and consider an authorized application and API assessment.
Key Takeaways
Spyware is hidden monitoring software, and many odd device behaviors have harmless causes.
Battery drain and heat are weak clues. Unknown admin apps, unfamiliar account sessions, and someone knowing private details are stronger.
If a partner or ex may be monitoring you, safety and evidence come before removal, and research should happen on another device.
A clean scan lowers risk but does not prove a device is safe.
Each platform has its own path: Defender full and offline scans on Windows, app, login item, and permission review on Mac, Play Protect and permission checks on Android, and Safety Check, account devices, and profiles on iPhone.
Account compromise is not the same as device infection, so change credentials from a clean device and revoke sessions.
AV-TEST results show strong general protection from several products, but they do not prove stalkerware detection.
Businesses should layer endpoint protection, multifactor authentication, logging, response plans, and authorized application and API assessments. A penetration test does not clean devices.
Actionable Next Steps
Check your safety. If someone may be monitoring you, use another device and contact a local advocate. In the US, call 1-800-799-7233.
Write down what you noticed and when it started.
Review accounts from a trusted device: logins, connected devices, and recovery details.
Update the operating system and apps.
Run built-in protection: Defender full and offline scans on Windows, Play Protect on Android, a Mac review, or Safety Check on iPhone.
Remove unknown apps, extensions, permissions, and profiles once evidence is saved.
Change passwords, revoke sessions, and turn on multifactor authentication from a clean device.
Prevent a repeat: keep updates on, install from trusted sources, lock devices, and back up files.
Business readers: involve your security team, and if your applications or APIs need review, scope an authorized assessment with a qualified provider.
Get professional help if signs persist or the situation involves abuse or a targeted attack.
Glossary
Spyware: Software that secretly monitors a device or its owner and collects data.
Malware: Harmful software built to damage systems, steal data, or gain unauthorized access.
Stalkerware: Spyware used to monitor a particular person, often a partner or ex-partner, without consent.
Keylogger: A tool that records what a person types.
Infostealer: Malware that collects saved passwords, browser sessions, and files.
Trojan: Malware disguised as a useful program.
Persistence: Methods that let malicious software survive restarts or cleanup.
Rootkit: Malware that hides deep in a system, below the normal operating system view.
Endpoint protection: Security software and controls on devices such as laptops and phones.
False positive: A safe item wrongly flagged as harmful.
Multifactor authentication (MFA): Signing in with more than a password, such as a code or passkey.
Management profile: Settings an organization pushes to a device. Legitimate on work devices, suspicious on a personal one. See configuration management.
Session token: A digital key that keeps you signed in. A thief can reuse a stolen one.
Digital forensics: Evidence-grade examination of devices and data.
Incident response: The process of containing and recovering from a security incident.
Penetration testing: An authorized, scoped, point-in-time test of systems or applications to find weaknesses.
Sources & References
Stalkerware: What To Know. Federal Trade Commission, Consumer Advice. Modified 2026-08-10.
Malware: How To Protect Against, Detect, and Remove It. Federal Trade Commission, Consumer Advice. Modified 2026-05-01.
Run and review the results of a Microsoft Defender Offline scan. Microsoft Learn. Updated 2026-07-03.
Use Google Play Protect to help keep your apps safe & your data private. Google Play Help. n.d.
Safety Check for iPhone. Apple Personal Safety User Guide. n.d.
Get safe guide: Strategies for getting safe. Apple Personal Safety User Guide. n.d.
Harden your devices against mercenary spyware with Lockdown Mode. Apple Personal Safety User Guide. n.d.
Protecting against malware in macOS. Apple Platform Security. Published 2024-12-19.
Test antivirus software for Windows 11, August 2026. AV-TEST. Tests run July to August 2026.
Test antivirus software for Android, September 2026. AV-TEST. September 2026.
AV-TEST Awards 2025. AV-TEST. 2026-03-12.
Input Capture, Technique T1056. MITRE ATT&CK. Last modified 2025-10-24.
How to remove Android spyware. TechCrunch. 2025-02-20.
Penetration Testing Services for Businesses. Articsledge. n.d.
