Spyware/Malware Checklist#

What is stalkerware?#

Mobile stalkerware (sometimes called spouseware in the context of domestic violence) is a category of surveillance software that is installed on a person’s device without their informed consent or knowledge. Its primary purpose is to monitor and exfiltrate sensitive personal data such as:

• Location and movement history
• Text messages and call logs
• Photos and media
• Browser activity and search history
• App usage and notifications

Monitoring software can have legitimate, legal uses. For example:

• Employers may monitor activity on company-owned devices with clear disclosure
• Parents may monitor a child’s device for safety or parental control purposes.

However, stalkerware differs in that it is explicitly designed to be hidden and to collect data without the device owner’s awareness or consent. For this reason, stalkerware often exists in a legal and ethical gray area, even when marketed as “monitoring” or “parental control” software.

Some stalkerware products were originally developed for corporate or parental use cases, but are frequently repurposed for covert surveillance.

Common Stalkerware Behaviors#

To avoid detection, stalkerware commonly:

• Runs silently in the background with no visible app icon
• Disguises itself as a system service or generic app
• Requests high-risk permissions, such as:
  • Accessibility Services
  • Device Administrator privileges
  • Notification access
• Persists across reboots
• Attempts to prevent uninstallation. May notify the person who installed it about uninstallation attempts.

How Is Stalkerware Installed?#

Stalkerware is typically not installed through the Google Play Store, and instead via a process called sideloading.

In many cases:

• The person installing the stalkerware has brief physical access to the victim’s device
• They enable “Install unknown apps” or “Allow from this source”
• They follow step-by-step instructions provided by the stalkerware vendor
• The app is installed directly via APK file download

Sideloading does not require advanced technical knowledge; tutorials are widely available online, making this method accessible to non-technical users.

Protections and Detection#

1. Enable Google Play Protect#

Google Play Protect is Android’s built-in security service that:

• Scans apps before download
• Periodically scans all installed apps (including sideloaded ones)
• Warns about or removes harmful application

To enable Google Play Protect:

1. Open the Google Play Store
2. Tap your profile icon (top right)
3. Select Play Protect
4. Review scan results and enable scanning if disabled

2. Review Accessibility Services#

Accessibility Services are intended to help users with disabilities, but they require extensive system access, making them a common target for stalkerware.

To review accessibility access:

1. Open Settings
2. Navigate to Accessibility
3. Select Installed apps or Downloaded apps
4. Review all apps with accessibility permissions
5. Disable access for any app you do not recognize

If you do not use accessibility features, this list should be empty or very small. Be cautious of apps with generic, innocuous names.

3. Check Notification Access#

Apps with notification access can read messages, OTPs, and other private information.

To review notification access:

1. Open Settings
2. Go to Security & Privacy (or Privacy)
3. Select Special app access
4. Tap Notification access
5. Disable access for unknown or suspicious apps

4. Review Device Administrator Apps#

Older versions of Android allow apps to register as Device Admins, granting powerful control over the device.

To review Device Administrator apps:

1. Open Settings
2. Go to Security
3. Select Device admin apps
4. Disable any unrecognized apps

5. Review All Installed Apps#

Some stalkerware apps hide their icons but still appear in the app list.

To review installed apps:

1. Open Settings
2. Go to Apps
3. Tap See all apps
4. Look for unfamiliar apps
5. You can see permissions for a specific app by tapping on it. Review permissions for access to:
   • Location
   • Camera
   • Microphone
   • Call logs
   • Contacts
   • Files

Anti-Malware Software#

Anti-malware apps to help detect and remove these spyware apps exist. Top Android anti-malware apps include MalwareBytes, Incognito, Protectstar Anti Spy, and AVG AntiVirus & Security; upon installing them, these will give you the option to run a scan and detect any spyware apps, and also offer features like real-time protection, permission monitoring, and automatic threat removal.

Factory Reset (Last Resort)#

If you suspect persistent stalkerware or cannot safely remove an app, performing a factory reset can remove most malicious software.

Warning: A factory reset permanently erases all data on the device! Back up important files before proceeding.

To perform a factory reset:

1. Back up important data (photos, contacts, files) to a trusted account or offline storage
2. Open Settings
3. Navigate to System
4. Select Reset options
5. Tap Erase all data (factory reset)
6. Confirm the reset and wait for the device to restart

After resetting, do not restore apps from unknown backups, as this may reintroduce unwanted software. Only reinstall apps you recognize from the Google Play Store.

Common Spyware Apps#

This is not an exhaustive list. These examples are compiled from public reports and blogs.

References#

1. https://techcrunch.com/2025/02/20/remove-android-spyware/
2. https://ieeexplore.ieee.org/stamp/stamp.jsp?tp=&arnumber=10185812
3. https://www.zscaler.com/blogs/security-research/new-wave-stalkerware-apps
4. https://www.malwarebytes.com/blog/news/2016/10/mobile-menace-monday-beware-of-monitoring-apps
5. https://www.malwarebytes.com/blog/android/2019/06/mobile-stalkerware-a-long-history-of-detection?_gl=1*1e0y5s4*_gcl_au*MTcyNTAxMDE1OS4xNzY3MjQ5MjEx*_ga*NDQ1NDkxNTkxLjE3NjcyNDkyMTE.*_ga_K8KCHE3KSC*czE3NjkwMjc1MDgkbzIkZzAkdDE3NjkwMjc1MDgkajYwJGwwJGgw
6. https://www.protectstar.com/en/blog/detecting-removing-and-preventing-spyware-on-android-devices