Smart home camera hijacking, baby monitor hacks, and phone stalkerware¶

Discovering that a stranger is speaking through your child's Wi-Fi baby monitor, watching your living room through an indoor security camera, cycling your smart door locks and thermostat remotely, or tracking every message and GPS movement on your smartphone through hidden stalkerware is an immediate personal safety and privacy emergency. Smart home and mobile surveillance incidents fall into two distinct categories that require completely different responses: opportunistic remote attacks by external hackers using leaked passwords ("credential stuffing"), and targeted technology-facilitated abuse by a current or former intimate partner, roommate, or landlord who once had physical access to your home or devices.

If an external stranger hijacked a smart camera or baby monitor, cutting power to the device and rotating your cloud and Wi-Fi credentials stops the intrusion immediately. However, if you suspect a jealous partner, ex-partner, or domestic abuser installed stalkerware ("spouseware") on your phone or retains secret administrator access to your home locks, cameras, or connected car, abruptly wiping the software or changing shared passwords can immediately alert the abuser and trigger a dangerous escalation in physical violence. Safety planning from an unmonitored device must always come first.

Do this now¶

1. Unplug hijacked indoor cameras and baby monitors from the wall outlet immediately: Do not rely on turning the camera off inside a smartphone app. Pull the physical power cord out of the wall outlet and remove any backup batteries so the lens, microphone, and speaker are completely dead.
2. Preserve brief forensic evidence before resetting if safe to do so: Using a separate phone, take a quick photo or video of the camera flashing, the app's Connected Devices / Login History screen, or unfamiliar administrator accounts, and write down the exact minute the voice or unauthorized action occurred so your router logs and the manufacturer's cloud logs can be correlated.
3. Assess whether the intruder is a stranger or someone you know (Escalation Warning): If a former partner, spouse, roommate, or landlord ever lived in the home, knew your Wi-Fi password, or held your unlocked phone, assume they will receive an instant push notification the moment you revoke their access or remove stalkerware. Read the domestic safety section below before deleting anything.
4. Disconnect your home Wi-Fi router if smart locks, garage doors, or thermostats are being manipulated: Unplug the power cable from your Wi-Fi router and modem to sever all remote cloud command channels instantly, then operate your deadbolts and garage door manually using the physical release lever until you factory-reset the devices.
5. Use a completely clean, unmonitored device to change passwords and seek help: Never research stalkerware removal, domestic violence shelters, or legal orders on a phone or laptop you suspect is monitored. Use a library computer, a trusted friend's phone, a workplace desktop, or a cheap prepaid burner phone purchased with cash and kept on cellular data away from your home Wi-Fi.
6. Enable phishing-resistant Multi-Factor Authentication (MFA) and click "Sign Out of All Devices" on your primary email and smart home cloud accounts: From a clean device, change the password on your primary email account first, then change the password on your Ring, Nest, Arlo, Wyze, Eufy, Apple Home, Google Home, or Amazon Alexa account, enable two-factor authentication, and revoke all active sessions and shared household users.

flowchart TD
    A["Suspected Camera Hijack, Smart Home Manipulation, or Phone Stalkerware"] --> B{"Who Is the Suspected Intruder?"}
    B -- "External Stranger / Opportunistic Hacker" --> C["Unplug Indoor Cameras & Baby Monitors From Wall Power Immediately"]
    C --> D["Log Into Smart Home App From Clean Device & Screenshot Login History"]
    D --> E["Reset Primary Email Password + Smart Home Cloud Password & Enable MFA"]
    E --> F["Factory Reset Affected IoT Devices, Update Firmware, and Move to Guest/IoT Wi-Fi VLAN"]
    B -- "Current or Former Partner, Roommate, or Stalker" --> G["STOP: Do Not Delete Stalkerware or Revoke Access Yet (Risk of Escalation Alert)"]
    G --> H["Use Unmonitored Device (Friend's Phone, Library PC, or Cash Prepaid Phone) to Contact Safety Advocates"]
    H --> I["Audit iOS / Android Permissions, iCloud / Google Account Sync, and Connected Vehicle Apps"]
    I --> J{"Ready to Exit Safely or Have Police / Restraining Order Protection?"}
    J -- "Yes" --> K["Factory Reset Router, Revoke Shared Home/Car Access, and Replace or DFU-Wipe Phone"]
    J -- "No" --> L["Keep Decoy Normal Activity on Monitored Phone While Using Secret Clean Phone for Exit Plan"]

Part 1: Indoor security camera and Wi-Fi baby monitor hijacking¶

When a stranger's voice suddenly talks through a nursery baby monitor or an indoor pan-tilt security camera begins rotating on its own to follow you across the room, the experience is deeply violating. However, in over 95 percent of reported consumer cases, the attacker did not "hack" the encrypted radio waves outside your house; instead, they logged directly into your camera's web portal using a password leaked in an unrelated website data breach.

How attackers hijack smart cameras and baby monitors¶

Understanding the exact technical pathway tells you which security control failed:

1. Credential Stuffing on Cloud Camera Accounts (Most Common): If you used the same email address and password on a smart camera app (such as Ring, Nest, Wyze, Arlo, Blink, or Eufy) that you previously used on a breached retail, gaming, or forum website, automated criminal bots test millions of leaked email-and-password pairs against smart camera login servers. Once a bot gets a hit, the credentials are sold on criminal forums where voyeurs and trolls log directly into your live camera stream and press the "Two-Way Talk" microphone button.
2. Exposed UPnP Port Forwarding and Default Passwords on IP Cameras: Older or generic network cameras (RTSP/ONVIF IP cameras and Foscam-style monitors) often ship with a hardcoded default username and password (such as admin / admin or admin / 12345) and use Universal Plug and Play (UPnP) to automatically open an inbound port on your home router (Port 80, Port 554, or Port 8000). Search engines for internet-connected devices (such as Shodan or Censys) index these open ports automatically, allowing anyone on the internet to view the unauthenticated feed.
3. Shared "Household Member" or "Guest" Links: Former partners, babysitters, dog walkers, or prior tenants who were once invited as a "Shared User" inside your smart home app retain live camera and lock access indefinitely unless explicitly revoked, even if you change your own master password.
4. Local RF / FHSS Interception on Non-Wi-Fi Monitors: Non-Wi-Fi baby monitors that use older analog 900 MHz / 2.4 GHz radio signals can occasionally pick up cross-talk from a neighbor's cordless phone or baby monitor within 100 to 300 meters (330 to 985 feet). Modern DECT 6.0 or FHSS (Frequency-Hopping Spread Spectrum) dedicated non-Wi-Fi monitors encrypt and hop frequencies hundreds of times per second and cannot be accessed from the internet at all.

Immediate containment checklist for hijacked cameras and smart home hubs¶

• Step 1: Pull the physical power plug: Unplug the USB-C or barrel power adapter from the back of every indoor camera and baby monitor. If the camera has an internal lithium battery, hold the physical power button for 15 seconds until it powers down, or place the camera face-down inside a closed drawer or closet wrapped in a thick towel so both the lens and microphone are muffled while you secure your accounts.
• Step 2: Check the app's Authorized Devices and Shared Users list: Before deleting the device from your account, open the camera app's Account Settings > Security > Authorized Client Devices or Login Activity and take a screenshot showing any unrecognized IP addresses, cities, or phone models (for example, an unrecognized "iPhone 15 in Frankfurt" or "Web Browser in Moscow"). Next, open Shared Users / Household Members and remove every person you do not completely trust.
• Step 3: Change your primary email password, then your camera cloud password: Because an attacker with access to your email inbox can simply intercept "Reset Password" emails, secure your primary email account first with a unique 20-character password and two-factor authentication, then change your camera vendor password to a completely unique passphrase.
• Step 4: Force Mandatory Two-Factor Authentication (2FA): Enable 2FA inside your camera app using an authenticator app (such as Google Authenticator, Ente Auth, or 1Password) rather than SMS text messages where supported. Turning on 2FA and resetting your password typically forces the cloud server to invalidate all active streaming tokens within minutes.
• Step 5: Press the physical hardware Factory Reset pinhole on the camera: Plug the camera back in while holding down the recessed hardware Reset button for 10 to 15 seconds until the indicator light flashes and the voice prompt confirms a factory reset. Re-pair the camera to your account, install all pending Firmware Updates, and disable Two-Way Audio / Microphone Recording inside the settings for any indoor camera where voice chat is not strictly needed.

Part 2: Smart locks, thermostats, speakers, and connected cars in domestic disputes¶

In landlord-tenant lockouts, messy breakups, and domestic abuse cases, smart home ecosystems (Amazon Alexa, Google Home, Apple HomeKit, Samsung SmartThings) and connected vehicle smartphone apps (Tesla, FordPass, MyChevrolet, Toyota, Hyundai Bluelink, Subaru Starlink, Mercedes me) are frequently weaponized for remote harassment, sleep deprivation, and real-time GPS stalking.

Securing smart locks, garage doors, and thermostats¶

If your lights flash at 3:00 AM, your thermostat suddenly spikes to 32 degrees Celsius (90 degrees Fahrenheit) or drops to 10 degrees Celsius (50 degrees Fahrenheit), or your smart deadbolt unlocks itself:

1. Pull the interior battery pack out of your smart deadbolt: Every smart deadbolt (Schlage, Yale, August, Kwikset, Aqara, Level) is powered by 4 to 8 AA batteries or a rechargeable lithium pack located beneath the interior thumb-turn cover inside your house. Slide off the interior cover and remove the battery pack. Without battery power, the radio chip is 100 percent offline and cannot be unlocked by any app, PIN code, or Wi-Fi command, while your physical metal key and interior manual thumb-turn continue to work normally.
2. Pull the emergency manual release cord on your smart garage door opener: If an unauthorized person has access to your MyQ, Genie Aladdin, or Meross garage controller, unplug the smart bridge from the wall outlet or pull the red emergency release cord hanging from the garage door trolley track and slide the physical interior garage side-bolt shut.
3. Pull the smart thermostat faceplate off the wall: Smart thermostats (Google Nest, Ecobee, Honeywell Home) snap onto a low-voltage wiring baseplate on the wall. Grip the thermostat unit firmly and pull it straight off the wall pins to stop remote temperature manipulation until you can factory-reset the unit under Settings > Reset > Account Connection / All Settings and bind it to a brand-new email account.
4. Audit Smart Home Hub "Home Members" and Linked Voice Assistants:
5. Apple Home (HomeKit): Open the Home app on your iPhone/iPad, tap the Three Dots icon (top right) > Home Settings. Inspect the People list and remove any former partner or roommate. Scroll down to Cameras & Doorbells and Allow Speaker & TV Access and restrict access to "Only People Sharing This Home".
6. Google Home: Open the Google Home app, tap Settings > Household, select any unauthorized person, and tap Remove Member. Also check Settings > Works with Google to unlink any third-party automation platform (such as IFTTT or Home Assistant) that an abuser may have linked.
7. Amazon Alexa: Open the Alexa app, go to More > Settings > Your Profile & Family, and check Amazon Household to remove any linked adult profile (amazon.com/myh/manage). Disable Drop In permissions across all Echo speakers so no outside contact can turn your smart speaker into an open intercom without your consent.

Auditing Connected Car apps (The overlooked GPS stalker vector)¶

Modern cars manufactured after 2016 contain built-in cellular modems and GPS transceivers that report the vehicle's exact street address, speed, trip history, and parked location to a smartphone companion app 24 hours a day. Even if you take back the physical car keys from an ex-partner, their phone app can still track where you park, unlock your car doors remotely, or flash the horn and lights unless you revoke their digital driver profile.

• How to sever connected car stalking:
• Sit inside the vehicle and open the center dashboard infotainment touchscreen. Go to Settings > Profiles / Connected Services / Data & Privacy and inspect all paired phones and authorized driver profiles.
• Call the vehicle manufacturer's customer support button (the physical SOS / Info / OnStar / Connected Services button near the rearview mirror) or call the automaker's main customer care number with your Vehicle Identification Number (VIN) and proof of ownership/registration (or a copy of a domestic violence protection order). Ask the agent to perform an immediate Master Account Reset, delete all secondary authorized app users, and transfer primary telematics ownership exclusively to your new, private email address.
• Tesla vehicles: Open the touchscreen (Controls > Locks) to inspect every registered Phone Key and key card; delete any unfamiliar Phone Key immediately, then open the Tesla app (Security & Drivers > Manage Drivers) to remove secondary drivers and change your Tesla account password.

Part 3: Smartphone stalkerware, spouseware, and spyware detection¶

Stalkerware (also marketed commercially as "spouseware", "employee monitoring software", or "parental control apps" such as mSpy, FlexiSPY, Cocospy, Hoverwatch, Eyezy, uMobix, or Spyera) is covert surveillance software installed onto a smartphone by someone who has physical access to the unlocked device and knows the user's screen passcode. Once installed, stalkerware runs silently in the background with a hidden or disguised icon (often named "System Service", "Device Health", "Wi-Fi Settings", or "Update Manager") and uploads your real-time GPS location, SMS text messages, WhatsApp/Signal chats, call logs, photos, web browsing history, and ambient microphone recordings to a web dashboard controlled by the abuser.

Cloud Account Stalking vs Installed Stalkerware Apps¶

Before hunting for exotic spyware apps, understand that 80 percent of smartphone stalking requires zero software installation on your phone. If someone knows your Apple ID (iCloud) password or Google Account password, they can log into icloud.com/find or google.com/android/find from any web browser, see your exact real-time GPS location, read your backed-up iMessages, WhatsApp backups, photos, and contacts, and clone your phone onto an old iPad or tablet hidden in their drawer.

flowchart TD
    A["Suspect Phone Is Being Monitored by Partner or Stalker"] --> B["Check Vector 1 First: Cloud Account & Built-In Location Sharing (80% of Cases)"]
    B --> C["On iPhone: Run Apple 'Safety Check' (Settings > Privacy & Security > Safety Check)"]
    B --> D["On Android: Check Google Find My Device, Google Maps Location Sharing & Linked Devices"]
    C --> E["Check Vector 2: Linked Messaging Web Sessions (WhatsApp, Signal, Telegram, iMessage on Mac/iPad)"]
    D --> E
    E --> F["Check Vector 3: Sideloaded Android Stalkerware APKs or iOS MDM Configuration Profiles"]
    F --> G{"Did You Find Active Stalkerware or Unauthorized Cloud Sync?"}
    G -- "Yes" --> H["Screenshot Evidence Using a SECOND Separate Camera (Do Not Screenshot on the Infected Phone)"]
    H --> I["When Safe to Exit: Factory Reset (or DFU Restore) Phone and Create Brand-New Cloud Account"]

How to audit an iPhone (iOS) for stalking and spyware¶

Because Apple's iOS operating system enforces strict hardware-verified app sandboxing (App Store code signing), commercial stalkerware cannot be sideloaded onto a normal, non-jailbroken iPhone without leaving visible system markers. Instead, iPhone stalkers use four specific mechanisms that you can audit in 3 minutes:

1. Run Apple's built-in "Safety Check" tool (iOS 16 and newer):
2. Open Settings > Privacy & Security > Safety Check.
3. Apple created this feature specifically with domestic violence advocacy groups. You can choose Manage Sharing & Access (to quietly review and selectively revoke who can see your Find My location, Shared Photo Albums, Calendar, HomeKit accessories, and which other iPhones, iPads, or Macs are signed into your Apple ID) or tap Emergency Reset (which immediately severs all location sharing with everyone, resets system privacy permissions, signs out of iCloud on all other devices, and restricts iMessage and FaceTime strictly to the iPhone in your hand).
4. Check for hidden MDM / Configuration Profiles and Jailbreaks:
5. Commercial iPhone spyware that does not use iCloud backups requires physically plugging your unlocked iPhone into a computer and installing a Mobile Device Management (MDM) Configuration Profile (or jailbreaking the phone).
6. Open Settings > General > VPN & Device Management. For a normal personal consumer iPhone (that is not managed by your corporate employer), there should be zero Configuration Profiles or MDM profiles listed here. If you see an unfamiliar Device Management profile or root certificate, someone with physical access installed a management profile on your phone.
7. Check App Privacy Report and Microphone / Camera Indicators:
8. Watch the very top right corner of your iPhone screen: iOS displays a mandatory orange dot whenever any app is actively using your microphone, and a green dot whenever any app is using your camera. Swipe down to open Control Center while the dot is visible to see the exact name of the app using the sensor.
9. Turn on Settings > Privacy & Security > App Privacy Report to see a timestamped log of every app that accessed your location, microphone, camera, contacts, or photos over the last 7 days.
10. Turn on Lockdown Mode if you face nation-state or high-end commercial mercenary spyware:
11. If you are a journalist, human rights defender, executive, or high-profile target worried about zero-click mercenary spyware (such as Pegasus or Predator), go to Settings > Privacy & Security > Lockdown Mode and turn it on.

How to audit an Android phone for hidden stalkerware¶

Because Android allows users (or someone holding your unlocked phone for 3 minutes) to toggle on "Install unknown apps" and sideload hidden .apk stalkerware files directly from a web browser, Android requires a deeper 5-step permission audit:

1. Verify that Google Play Protect is still turned ON:
2. When an abuser installs commercial stalkerware (like mSpy or FlexiSPY) on an Android phone, step one of the spyware's installation manual instructs them to turn off Google Play Protect so the phone will not pop up a warning banner saying a harmful spyware app was detected.
3. Open the Google Play Store app, tap your Profile Icon (top right) > Play Protect > Settings (gear icon). If Scan apps with Play Protect is toggled OFF, that is a major red flag that someone manually disabled your phone's anti-malware scanner to hide sideloaded stalkerware. Turn it back on (only when you are ready for the stalkerware to be detected and blocked).
4. Audit the "Accessibility Services" menu (The #1 Android Stalkerware Hook):
5. Modern Android stalkerware cannot read your WhatsApp, Signal, or social media messages unless the installer grants the spyware app Accessibility Service permissions (a feature meant for blind or motor-impaired users that allows an app to read every word on the screen and log every keystroke).
6. Open Settings > Accessibility > Installed apps (or Downloaded apps). Inspect every single app listed here. If you see an app named "System Update", "Device Health Service", "Wi-Fi Sync", "Settings Helper", or any app you did not explicitly configure for a disability or password manager, it is almost certainly stalkerware.
7. Audit "Device Admin Apps" and "Notification Access":
8. Open Settings > Security & Privacy > More security settings > Device admin apps (or search Settings for "Device admin"). Stalkerware registers itself as a Device Administrator to prevent you from uninstalling it until you uncheck its admin box here.
9. Search Settings for "Notification access" (or Special app access > Notification access). Any app toggled ON here can silently copy every incoming SMS, Signal, and WhatsApp notification.
10. Search the complete All Apps list for blank or disguised icons:
11. Go to Settings > Apps > See all [X] apps. Tap the three dots in the top right and select Show system. Scroll slowly through the list looking for apps that have a completely blank white or transparent icon, generic system-sounding names that consume high battery or mobile data in the background, or apps installed via a web browser rather than the Google Play Store (tap the app and scroll to the very bottom under App details in store: a real system or Play Store app says "App installed from Google Play Store", whereas sideloaded stalkerware says "Installed from Chrome" or "Package Installer").
12. Audit Google Maps Location Sharing and Linked Messaging Devices:
13. Open the Google Maps app, tap your Profile Icon > Location sharing, and verify that your live location is not being shared with an abuser's email address or via a permanent web link.
14. Open WhatsApp (Settings > Linked Devices), Signal (Settings > Linked Devices), Telegram (Settings > Devices), and Google Messages (Device pairing). If an attacker scanned a QR code on your unlocked phone for 5 seconds while you were in the shower, they have a live mirror of every encrypted chat on their laptop browser.

Part 4: Securing your home Wi-Fi router and building a clean digital baseline¶

Once you are physically safe and ready to cut off an intruder or abuser completely, lock down your home network and devices in this exact order:

1. Press the hardware Factory Reset pinhole on your Wi-Fi router: If a former partner, roommate, or hacker ever knew your router's admin password, had the router vendor's mobile app (such as Eero, Netgear Nighthawk, TP-Link Deco, Google Nest Wifi, or Asus Router) installed on their phone, or configured remote management / DDNS, changing your Wi-Fi password alone is not enough. Hold the physical reset pinhole on the back of the router for 15 seconds, set up the router under a brand-new cloud account, create a new Router Admin Password, set a new Wi-Fi network name (SSID) and WPA2/WPA3 passphrase, and disable UPnP (Universal Plug and Play) and Remote Web Management.
2. Move all smart cameras, locks, and TVs onto an isolated "Guest Wi-Fi" network: Turn on your router's Guest Wi-Fi Network (with "Client Isolation" enabled) and connect all smart cameras, baby monitors, smart plugs, robot vacuums, and smart TVs to the Guest network, while keeping your personal laptops and smartphones on the main network. That way, a compromised smart gadget can never scan or eavesdrop on your personal computers.
3. Perform a clean Factory Reset (or Replacement) of an infected smartphone:
4. Because deep stalkerware can hide persistence files or configuration profiles that survive basic app uninstallation, the only 100 percent reliable way to clean a phone that had stalkerware installed is a full Factory Reset (Settings > System > Reset options > Erase all data (factory reset) on Android, or Settings > General > Transfer or Reset iPhone > Erase All Content and Settings, or a computer DFU Mode Restore, on iPhone).
5. CRITICAL: When setting the phone back up after the factory reset, do NOT choose "Restore from iCloud / Google Cloud Backup", because restoring a full device image can automatically re-download the hidden stalkerware app or compromised settings right back onto the clean phone. Instead, choose "Set up as a new device", sign in with a brand-new or fully secured cloud account, and manually download only the well-known apps you recognize from the official App Store or Play Store.

Frequently asked questions¶

Sources checked¶

• Cybersecurity and Infrastructure Security Agency (CISA) and Federal Bureau of Investigation (FBI, United States): Securing Smart Home Internet of Things (IoT) Devices, Mitigating Camera Hijacking, and Consumer Guidance on Stalkerware.
• National Network to End Domestic Violence (NNEDV Safety Net Project, United States): Technology Safety & Privacy Toolkit for Survivors: Assessing Spyware, Smart Home Abuse, and Connected Vehicle Safety.
• National Cyber Security Centre (NCSC, United Kingdom): Smart Security Cameras: Using Them Safely in Your Home, and Guidance for Domestic Abuse Survivors on Device Security.
• Coalition Against Stalkerware (International Working Group / Electronic Frontier Foundation, Kaspersky, Malwarebytes, Avast, NNEDV, WEISSER RING): Indicators of Stalkerware, Safe Detection Procedures, and Non-Escalation Protocols.
• Apple Platform Security (United States): Personal Safety User Guide for Apple Devices: Using Safety Check in iOS, Auditing Configuration Profiles, and Lockdown Mode.
• eSafety Commissioner (Australian Government, Australia): Technology-Facilitated Abuse: Auditing Smart Home Devices, Cloud Accounts, and Mobile Spyware Safely.

Related guides¶

• Securing home routers and IoT devices
• GPS tracker and AirTag stalking
• Domestic violence
• Stalking and physical surveillance defense