How to detect stalkerware

Most malware is opportunistic — it does not care who you are. Stalkerware is the opposite. It is commercial monitoring software, often marketed euphemistically as "parental control" or "employee tracking", that is deliberately installed on a specific person's device by someone with access to it: a partner, ex-partner, family member or employer. Because the installer knows you, stalkerware is both more targeted and more emotionally fraught than typical infections.

What stalkerware can see

Depending on the product and permissions, stalkerware can monitor messages and social-media chats, track real-time location, log calls, read contacts, view photos, record keystrokes, and even activate the microphone or camera. It is designed to run invisibly, hiding its icon and disguising its name so the person being monitored never suspects.

The warning signs

• Battery and heat. Constant background monitoring drains the battery and warms the device even when idle.
• Data usage. Your private information has to be uploaded somewhere, which shows up as unexplained mobile-data consumption.
• Behavioural tells. The most reliable sign is human: someone knows about conversations, plans or locations you never shared with them.
• The phone left your sight. Stalkerware almost always requires physical access to install. If your device was out of your control and your passcode was known, that is the likely moment.

Detecting it on Android

Android is the more common target because apps can be sideloaded. The key checks are device-admin apps, accessibility services and the full app list — covered in depth in our Android detection guide. In short: anything with device-admin rights or accessibility access that you did not deliberately set up is suspect.

Detecting it on iPhone

iOS stalkerware usually relies on configuration profiles, a jailbreak, or stolen Apple ID credentials. Check Settings → General → VPN & Device Management for unknown profiles, search for jailbreak apps, and review the devices signed in to your Apple ID. Full steps are in our iPhone detection guide.

Confirming with a scan

If you find an app or installer you cannot identify, you can confirm it rather than guess. Export the installer and run it through our scanner, which checks it against known stalkerware families and the community database. A documented verdict is also useful if the situation may involve law enforcement or a protective order.

Responding safely — this part matters

With ordinary malware, you simply remove it. With stalkerware, removal can alert the person monitoring you, and in abusive situations that can escalate danger. Consider this sequence:

1. Do not act impulsively. If you feel unsafe, think through the consequences of the monitor suddenly losing access.
2. Preserve evidence. Screenshots of suspicious apps, permissions and data usage can matter legally.
3. Use a safe device. Research and reach out for help from a device the monitor cannot see — a friend's phone or a public computer.
4. Seek support. Domestic-violence and digital-safety organisations have specific expertise in technology-facilitated abuse and can help you plan.
5. Then remove it when you have a plan — or factory reset for a clean slate — and change all passwords from a trusted device.

Preventing reinstallation

After cleaning a device, set a passcode only you know, enable two-factor authentication on your accounts, keep the operating system updated, and consider real-time protection that alerts you if monitoring software is installed again.