What Is Spyware? Warning Signs and How to Remove It From Your Phone

Spyware is software that installs itself on a phone or computer and secretly collects information, like location, messages, call logs, or browsing activity, and sends it to someone else without the device owner's knowledge. It is a category of malware, but it is defined by what it does rather than how it spreads: a program only counts as spyware if its purpose is covert monitoring. A consumer version of spyware, often called "stalkerware," is sold openly to install on a partner's or family member's phone for covert surveillance, and it is frequently used in situations of domestic abuse. This guide explains the difference, the warning signs on iPhone and Android, how spyware typically gets installed, and the safest way to check for it and remove it.

What is spyware?

Spyware is malware built to gather information about a person or organization and send it to someone else, typically without the device owner's consent. According to Wikipedia's overview of spyware, it is a broad category that includes system monitors, tracking tools, keyloggers that record what you type, and software that "phones home" with usage data. What separates spyware from a virus or worm is intent and behavior: spyware does not usually try to copy itself to other devices. Instead, it relies on being installed, either by tricking a user into downloading something, by exploiting a software vulnerability, or by someone with physical access to the device installing it directly.

Spyware can be bundled with otherwise legitimate-looking apps, hidden inside a trojan, or, in the case of commercial spyware and stalkerware, installed deliberately by someone who has (or once had) access to your phone. Because it is designed to run quietly in the background, most people never see a popup or warning. The first sign is usually indirect: strange battery or data behavior, or someone knowing information they should not have.

Spyware vs. malware vs. stalkerware: what's the difference?

These three terms get used interchangeably, but they describe different things:

• Malware is the umbrella term for any malicious software, including viruses, ransomware, rootkits, and spyware. Not all malware spies on you; some just destroys data, demands payment, or hijacks your device's resources. For a broader rundown, see our guide to what malware is and how it spreads.
• Spyware is the subset of malware whose job is covert data collection: reading messages, tracking location, logging keystrokes, or capturing browsing history. A keylogger is one specific type of spyware that focuses on recording what you type, such as passwords.
• Stalkerware is spyware sold commercially, usually marketed as "parental monitoring" or "employee monitoring" software, but used in practice to secretly track a partner, ex-partner, or family member. The Coalition Against Stalkerware, a partnership of security companies and domestic-violence organizations, describes stalkerware as apps and tools that let someone monitor a partner's calls, messages, photos, and location "without the knowledge or consent" of the person being tracked.

The practical difference matters because stalkerware is usually installed by someone the victim knows, often with direct physical access to an unlocked phone, rather than through a random malicious download. That changes both how it gets on the device and what the safest removal plan looks like, which is why we cover it separately below.

Warning signs of spyware on your phone

Spyware is built to be invisible, so there is rarely a single definitive sign. Instead, look for a pattern of several smaller anomalies. The Federal Trade Commission's consumer guide on stalkerware lists these as common indicators to watch for:

• Your battery drains noticeably faster than it used to.
• Your phone overheats, even when you are not actively using it.
• Your phone turns off and on unexpectedly, or behaves erratically.
• Someone seems to always know who you have been texting or talking to, or knows details from private conversations, your location, or sites you visited, without you ever telling them.

Beyond the FTC's list, a few device-specific signs are worth checking directly: unusually high mobile data use from an app you do not recognize, a new app icon you did not install, or (on iPhone) an unfamiliar device management profile. None of these alone proves spyware is present; phones can run hot or drain battery for ordinary reasons. But if several of these show up together, especially alongside someone knowing things they should not, it is worth doing the checks in the next sections.

How spyware gets on your phone

There is no single delivery method, but most cases fall into a few patterns:

• Direct physical installation. Stalkerware in particular is most often installed by someone who has had access to your unlocked phone, sometimes for just a few minutes, to install an app or enable a monitoring profile.
• Bundled or disguised apps. Spyware can ride along with a free app, disguise itself as a system utility, or be repackaged inside a trojanized version of a legitimate app downloaded outside an official app store.
• Malicious links or deceptive prompts. Tapping a link in a phishing text or email, or approving an install prompt without reading it, can trigger a spyware download, particularly on Android where apps can be installed from outside the Play Store.
• Device management or configuration profiles (iPhone). Because Apple restricts what regular apps can access, some iPhone monitoring tools rely on getting the device enrolled in mobile device management (MDM) or installing a configuration profile, sometimes framed as a "parental control" or "security" profile.
• Abused accessibility or admin permissions (Android). On Android, apps that gain Accessibility Service or device administrator access can read what's on screen and control the device at a level normal apps cannot, which is why monitoring apps often ask for these specific permissions during setup.

How to check for spyware on an iPhone

iOS does not include a built-in malware scanner, so checking for spyware on iPhone means manually reviewing a few specific settings:

1. Check for unknown configuration or device management profiles. Go to Settings > General > VPN & Device Management. If you see a profile you did not install, or a management profile on a personal phone that was never enrolled by a workplace or school, review what it is before removing it. Apple's support article on checking for VPN and third-party security software walks through locating these settings and removing a profile you no longer need.
2. Review the Personal Safety User Guide. If you are worried about someone else having access to your device or accounts, not just an app, Apple's own Personal Safety User Guide covers reviewing configuration profiles, checking sign-in attempts, and using Safety Check (on iOS 16 and later, under Settings > Privacy & Security > Safety Check) to see and reset what you are sharing and with whom.
3. Look for unfamiliar apps. Search your Home Screen and the App Library for anything you do not recognize, and check battery and data use per app under Settings > Battery and Settings > Cellular.
4. Update iOS. Software updates close the security holes spyware sometimes exploits to install itself. Go to Settings > General > Software Update and install anything available; Apple's iPhone User Guide on updating iOS covers both manual and automatic update steps.

How to check for spyware on Android

Android has a built-in scanner plus a few settings worth reviewing directly:

1. Run a Google Play Protect scan. Open the Google Play Store app, tap your profile icon, then tap Play Protect. According to Google's support page on Play Protect, it is on by default, continuously checks apps from the Play Store, and periodically scans your device for potentially harmful apps installed from any source, warning you about or removing ones it flags.
2. Review Accessibility and device administrator permissions. Monitoring apps frequently request Accessibility Service or device admin access because those permissions let an app see what's on screen or control the device at a deep level. Check your phone's Accessibility settings and device admin app list for anything you do not recognize or did not knowingly enable, and revoke access from apps you cannot identify.
3. Check for unfamiliar apps and unusual data use. Review your full app list in Settings > Apps (some monitoring apps hide their icon or disguise their name), and check per-app mobile data use, which on stock Android is under Settings > Network & internet > SIMs.
4. Consider whether the device is rooted. Some of the most invasive spyware requires root access to hide fully from the system. If you did not root the device yourself, that alone is a red flag.

How to remove spyware

Once you have found something suspicious, removal generally follows this order:

1. Remove or disable the specific app or profile. On iPhone, delete the configuration profile (Settings > General > VPN & Device Management, tap the profile, then remove it) and uninstall any unrecognized app. On Android, uninstall the app directly, or let Play Protect disable or remove it if it flags one.
2. Update the operating system. This closes vulnerabilities some spyware relies on to persist, and some updates specifically strip out known monitoring tools.
3. Change your passwords and enable two-factor authentication on your Apple ID or Google Account and any other accounts the spyware could have exposed, ideally from a device you know is clean.
4. If removal does not stick, or you cannot identify what is causing the symptoms, factory reset the device. On Android, Google's support page on resetting a device to factory settings notes this erases all data from the phone, so back up anything stored outside your Google Account first, and you will need your Google Account credentials and screen lock to get back in afterward. For either platform, do not restore apps from a backup that was taken while the spyware was installed; reinstall apps fresh from the App Store or Play Store instead, since restoring a backup can bring the spyware back with it.

If you think this is stalkerware: safety comes first

If the pattern points to someone you know, a current or former partner, a family member, deliberately monitoring you, the usual advice to "just delete the app" can carry real risk. The FTC's guidance and the Coalition Against Stalkerware both recommend treating this as a safety issue first, not only a technical one:

• Talk to a domestic violence advocate before removing anything. An abuser who notices they have suddenly lost access can escalate. The National Domestic Violence Hotline can be reached at 1-800-799-7233, through chat at thehotline.org, or by texting START to 88788.
• Use a different, trusted device (a friend's phone, a library computer) to look up resources or contact an advocate, rather than the phone you suspect is monitored.
• Document what you find before making changes, in case it is useful for a protective order or report later.
• Plan the reset or replacement with an advocate so it happens at a safer moment, rather than reflexively deleting the app the instant you find it.

This is not a situation where a purely technical fix is automatically the safest move. If any of this applies to you, the human safety planning matters as much as the removal steps above.

How to reduce the risk going forward

• Keep your phone locked with a passcode, and do not share it, even temporarily.
• Keep iOS or Android updated so known vulnerabilities get patched.
• Only install apps from the App Store or Play Store, and be cautious with install prompts or links in texts and email.
• Periodically check configuration profiles (iPhone) or accessibility/device admin permissions (Android) for anything you do not recognize.
• Enable two-factor authentication on your Apple ID or Google Account so a stolen password alone is not enough to get back in.

Spyware often arrives through the same openings as other malware, so broader habits help too; our guide to how rootkits hide on a device and how to remove them covers a related type of threat that some advanced spyware uses to stay hidden from normal detection.

What to do next

If you noticed a few of the warning signs above, start with the free checks: review configuration profiles on iPhone, run a Play Protect scan on Android, and look at which apps are using unusual battery or data. If what you find looks like ordinary adware or a stray app rather than targeted monitoring, removing it and updating your OS is usually enough. If the pattern instead points to someone specific having deliberately installed something to track you, pause before deleting anything and contact a domestic violence advocate or the National Domestic Violence Hotline first, then plan the removal with safety in mind. Either way, updating your device, tightening account security, and knowing where unfamiliar profiles or permissions live on your phone makes the next check much faster.

Written bySana Qureshi

Sana Qureshi runs the security and privacy desk. She reports on actively exploited vulnerabilities, vendor patches and data breaches, and covers the password managers, VPNs and authentication tools readers use to protect themselves. Her alerts cite vendor advisories, CISA and the CVE record directly.

More from Sana QureshiAll Security & Privacy coverage