Detecting stalkerware, spyware, and hidden access on phones¶

Suspecting that someone is secretly reading your text messages, listening to your phone calls, tracking your real-time GPS location, or watching every keystroke you type on your iPhone or Android smartphone is an urgent personal safety and digital security crisis. However, before you delete any suspicious app or change a single password on your phone, you must understand two critical facts about modern smartphone surveillance. First, physical escalation risk is real: in domestic abuse, coercive control, or stalking situations, deleting a stalkerware app (mSpy, FlexiSPY, Cocospy, Hoverwatch, uMobix, Eyezy, or KidsGuard) or cutting off location sharing sends an instant disconnection alert to the abuser's dashboard, which can trigger immediate physical retaliation. Second, 90 percent of modern smartphone spying is NOT an invisible "Hollywood hacker virus" installed over the internet, instead, it is done by someone who knew or guessed your 4-to-6-digit phone passcode, logged into your Apple iCloud / Google Account on another device, scanned your WhatsApp / iMessage / Signal Linked Devices QR code, enabled Android Accessibility / Device Admin sideloaded stalkerware, or placed your phone on a Shared Family Plan / MDM Profile.

If you are in immediate physical danger from a partner, stalker, or intruder right now, call your local emergency number (911 in the United States and Canada, 112 across the European Union, 999 in the United Kingdom) from a safe telephone or consult our directory of international emergency numbers. If you suspect your current phone is being monitored by an abusive partner or stalker, read Step 1 below before changing any settings on that device.

Do this now¶

1. Assess your physical safety BEFORE removing stalkerware or revoking account access: If an abusive partner, ex-partner, or stalker is monitoring your phone, wiping the device or kicking them out of your iCloud/Google account immediately alerts them that you have discovered the surveillance. If removing access could put you in physical danger, leave the monitored phone exactly as it is so it continues showing normal, boring activity, and buy a separate, cheap prepaid "Safe Phone" (Burner Phone) paid for with physical cash at a supermarket or pharmacy to call domestic violence shelters, attorneys, family, or police.
2. Never set up a new "Safe Phone" on your home Wi-Fi or link it to your old Apple ID, Google Account, or phone number: Keep your Safe Phone completely disconnected from your old digital life, create a brand-new Apple ID or Google Account with a fictional name, never connect it to your home Wi-Fi router (which logs connected device MAC addresses and hostnames), keep Bluetooth and Location Services turned off when not needed, and never call or text your old phone number from the Safe Phone.
3. If it is safe to lock down your current iPhone right now, run Apple's built-in Safety Check (Settings -> Privacy & Security -> Safety Check): Introduced for iOS 16, 17, and 18+, Safety Check provides a one-button Emergency Reset that immediately stops all Find My location sharing with everyone, resets privacy permissions (microphone, camera, photos, location) across all apps, restricts iMessage and FaceTime strictly to the single iPhone in your hand, and helps you remove unfamiliar devices from your Apple Account and change your passcode.
4. Check for "Zero-Install" Cloud & Messaging Mirroring (iCloud Devices, Google Find My Device, and WhatsApp Linked Devices): Before hunting for hidden spy apps, check the 3 places where 85 percent of real-world snooping happens:
   • WhatsApp / Signal / Telegram: Open Settings -> Linked Devices. If you see a Google Chrome (Windows/Mac) or Safari session you do not recognize, tap it and click Log Out immediately, someone scanned your QR code while you were asleep or in the shower and has been reading every message live on their laptop.
   • Apple iCloud / Google Account Device List: Check Settings -> [Your Name] on iPhone (scroll to the bottom) or myaccount.google.com/device-activity on Android to see if an old iPad, spare iPhone, or desktop computer is logged into your cloud account syncing your photos, texts, and live GPS location.
5. On Android, run a Google Play Protect scan and audit Accessibility Services, Device Admin Apps, and Notification Access: Unlike iPhones (which block sideloading outside specific regions), an attacker with 3 minutes of physical access to your unlocked Android phone can disable Google Play Protect, download an .APK stalkerware installer (disguised in your app list as System Update, Settings, Wi-Fi Service, or Device Health), and grant it full screen-reading Accessibility and Notification Listener permissions.
6. Before wiping a phone, take forensic screenshots or photos of the spyware with a second camera for law enforcement and family court: Installing stalkerware or intercepting private electronic communications without consent is a serious felony in the United States (Federal Wiretap Act, 18 U.S.C. § 2511 and CFAA, 18 U.S.C. § 1030), the United Kingdom (Computer Misuse Act 1990), Canada (Criminal Code s. 184 & s. 342.1), the European Union, and Australia. Before factory-resetting your phone, use a different phone's camera to photograph the unfamiliar Linked Devices, suspicious .APK permissions, and Account Login logs as admissible evidence for a restraining order or criminal prosecution.

Decision tree: diagnosing how your phone is being monitored¶

Use this technical triage flowchart to distinguish between Cloud/Account Mirroring, Commercial Stalkerware (.APK / MDM), Cellular Carrier Family Tracking, and Advanced Exploit Spyware:

flowchart TD
    A["Suspected Phone Surveillance: Texts Read, Calls Known, or Live Location Tracked"] --> B{"Is it physically safe to cut off the stalker's access right now?"}
    B -->|"No: Abuser is in the home or may retaliate violently"| C["Do NOT alter the monitored phone. Acquire a Cash-Purchased Prepaid Safe Phone on a Separate Cellular Network"]
    B -->|"Yes: Safe to audit and purge surveillance"| D{"What operating system does the phone run?"}
    D -->|"Apple iPhone (iOS)"| E["1. Run iOS Safety Check (Settings -> Privacy & Security -> Safety Check)"]
    E --> F["2. Check Settings -> General -> VPN & Device Management for MDM Profiles or Configuration Certificates"]
    F --> G["3. Audit WhatsApp/Signal Linked Devices, AirTag/Find My Alerts & Shared Mobile Carrier Account"]
    G --> H{"Do you suspect Zero-Click Nation-State Mercenary Spyware (Pegasus / Predator)?"}
    H -->|"Yes (Journalist, Dissident, Executive, High-Risk Target)"| I["Enable iOS Lockdown Mode, Reboot Daily, Capture Sysdiagnose & Scan with MVT (Mobile Verification Toolkit)"]
    H -->|"No (Domestic / Stalkerware Scenario)"| J["Change Device Passcode (6+ Digit Alphanumeric), Change Apple ID Password, Enable 2FA & Factory Reset if Jailbroken"]
    D -->|"Android (Samsung, Pixel, Motorola, etc.)"| K["1. Turn On Google Play Protect (Play Store -> Profile -> Play Protect -> Scan)"]
    K --> L["2. Audit Settings -> Accessibility, Device Admin Apps, Notification Access & Appear on Top"]
    L --> M["3. Audit WhatsApp/Google Messages Web Pairing (`messages.google.com/web`) & Google Location Sharing"]
    M --> N["Photograph Evidence with Second Camera, Back Up Only Plain Photos/Contacts, and Execute Full Factory Reset"]

Understanding the 4 tiers of mobile surveillance (How did they get in?)¶

When someone knows exact details from your private conversations or knows everywhere you drove today, it is easy to panic and think they have supernatural hacking abilities. In reality, smartphone surveillance falls into four concrete technical categories, and over 95 percent of domestic, relationship, and workplace cases are Tier 1, Tier 2, or Tier 3:

Phase 1: Complete step-by-step iPhone (iOS / iPadOS) spyware & stalkerware audit¶

Apple's iOS operating system enforces mandatory hardware-verified code signing and strict app sandboxing. An App Store app cannot secretly read your text messages, record your phone calls, or log your keystrokes outside its own app. Therefore, if someone is spying on your iPhone (assuming it is not visibly Jailbroken and you are not a target of a million-dollar government agency), they are using one of the seven specific iOS mechanisms below. Check every single one in order:

1. Run Apple Safety Check (iOS 16, 17, 18+)¶

1. Open Settings -> Privacy & Security -> scroll to the bottom and tap Safety Check.
2. Tap Manage Sharing & Access (if you want to inspect exactly who has access before cutting it off, so you can photograph it as evidence) OR tap Emergency Reset (to immediately cut off all sharing at once).
3. Inside Manage Sharing & Access, iOS shows you a unified forensic list of:
   • Every person you are sharing your Find My Location, Shared Photo Albums, Shared Calendars, Shared Notes, Shared Reminders, HomeKit Home, and Health Data with.
   • Every Shared Password (AirDrop / Passwords Family Sharing) group.
   • Every device signed into your Apple ID.

2. Inspect Settings -> [Your Name] for Secret Mirroring Devices (The "Hidden iPad" Trick)¶

1. Open Settings and tap [Your Name / Apple Account] at the very top.
2. Scroll all the way to the bottom to view your Device List.
3. What to look for: Look at every single iPhone, iPad, Mac, Apple Watch, or Windows PC listed. A very common domestic surveillance tactic is for a partner to take an old iPad or spare iPhone, sign it into your Apple ID using your phone passcode while you are asleep, turn off notifications on that iPad, and hide it in a drawer or briefcase. That hidden iPad receives every single iMessage, SMS (via Text Message Forwarding), photo, and live Find My ping in real time.
4. Tap any device you do not physically hold in your own possession right now and tap Remove from Account.
5. Next, go to Settings -> Apps -> Messages -> Text Message Forwarding (or Settings -> Messages -> Text Message Forwarding) and turn OFF any Mac or iPad listed there so standard green-bubble SMS texts are not mirrored to another screen.

3. Check for Rogue MDM (Mobile Device Management) Profiles and Root Certificates¶

While ordinary apps cannot spy on an iPhone, an enterprise Configuration Profile (.mobileconfig) or Mobile Device Management (MDM) profile, or a custom Root TLS Certificate, allows an administrator to route all your internet traffic through a proxy server, track device location, and inspect encrypted web traffic.

1. Open Settings -> General -> scroll down and tap VPN & Device Management.
2. What should be here: Unless your iPhone is owned by your employer or school, under Mobile Device Management or Configuration Profiles there should be ZERO profiles installed (only your normal consumer VPN app if you personally installed one like ProtonVPN or Mullvad).
3. If you see an unfamiliar MDM Profile, "Parental Control / Family Profile", or "Analytics / Beta Profile" you did not install, photograph it with another camera and tap Remove Management / Remove Profile.
4. Next, check for a hidden Man-in-the-Middle Root Certificate: Go to Settings -> General -> About -> Certificate Trust Settings (at the very bottom). Under Enable Full Trust for Root Certificates, there should be zero custom certificates toggled on. If one is toggled on, turn it off immediately and delete the profile.

4. Check for "Wi-Fi iTunes / Finder Backup Stalkerware" (iMazing / Desktop Stalkerware Sync)¶

How do commercial stalkerware websites (mSpy, Cocospy, Eyezy) claim to offer "No-Jailbreak iPhone Spyware"? They use two tricks: - Trick A (iCloud Backup Credential Scraper): The abuser types your Apple ID email, password, and a one-time 6-digit 2FA code (grabbed from your lock screen while you were asleep) into the stalkerware company's cloud server. Every night at 02:00 when your iPhone uploads its nightly iCloud Backup, the stalkerware server downloads a copy of your backup and extracts your texts, WhatsApp database, photos, and call history. - How to Kill Trick A Instantly: Change your Apple ID Password, remove unfamiliar Trusted Phone Numbers at Settings -> [Your Name] -> Sign-In & Security, and change your iPhone 6-digit Screen Lock Passcode (Settings -> Face ID & Passcode -> Change Passcode). - Trick B (Local Wi-Fi Sync to a Laptop on the Same Home Network): The abuser plugs your unlocked iPhone into their Windows PC or MacBook via a USB cable for 2 minutes while you are in the shower, taps "Trust This Computer" using your passcode, and checks the box in iTunes/Finder (or a commercial stalkerware desktop app) labeled "Sync with this iPhone over Wi-Fi". From that day forward, every single time you walk into the house and your iPhone connects to the home Wi-Fi, their laptop silently pulls a full forensic backup of your entire iPhone over Wi-Fi without ever plugging in a cable. - How to Kill Trick B Instantly: Even changing your Apple ID password does not revoke a local USB/Wi-Fi Computer Trust pairing. To wipe all trusted computers on iOS without resetting your whole phone, go to Settings -> General -> Transfer or Reset iPhone -> Reset -> Reset Location & Privacy (or change your passcode and enable Stolen Device Protection; plugging into a computer and resetting Sync History or performing a full Erase All Content and Settings permanently destroys all lockdownd pairing certificates).

5. Check Third-Party Location Apps (Google Maps, Life360, Snapchat Snap Map, Strava)¶

Apple's Safety Check resets Apple's native Find My location sharing, but an abuser may have turned on continuous 24/7 location sharing inside a third-party app that you already use every day: 1. Google Maps on iPhone or Android: Open the Google Maps app -> tap your Profile picture (top right) -> tap Location sharing. Verify that nobody is receiving your live 24/7 Google Maps location stream. 2. Audit Every App with "Always" Location Permission: Go to Settings -> Privacy & Security -> Location Services. Scroll down your entire app list and look for any app marked Always. Switch every app from Always to While Using the App or Never. 3. Check for Hidden Keyboard Extensions (Third-Party Keyloggers): Go to Settings -> General -> Keyboard -> Keyboards. It should only list English (or your native language) and Emoji. If you see any third-party keyboard with Allow Full Access enabled, delete it immediately.

Phase 2: Complete step-by-step Android spyware & stalkerware (APK) audit¶

Because Android allows users to install application packages (.APK files) directly from web browsers outside the Google Play Store, commercial stalkerware (mSpy, FlexiSPY, Hoverwatch, uMobix, TheTruthSpy, KidsGuard Pro, Spyic) is significantly more common as an actual installed background program on Android than on iOS.

When an abuser installs stalkerware on an Android phone, the installer prompts the abuser to turn OFF Google Play Protect, grant Accessibility Service / Device Admin / Notification Access permissions, and then hides its own icon from the home screen app drawer while masquerading inside the Settings menu under a fake system name like System Service, Update Service, Google Framework Service, Wi-Fi Helper, or Device Health.

Follow This 6-Step Android Detection & Removal Sequence¶

1. Step 1: Check and Re-Enable Google Play Protect Immediately:
   • Every commercial Android stalkerware installation guide instructs the abuser to turn off Google Play Protect as Step 1, because Play Protect detects and auto-disables known commercial stalkerware signatures.
   • Open the Google Play Store app -> tap your Profile icon (top right) -> tap Play Protect -> tap the Settings (Gear icon) in the top right corner.
   • If Scan apps with Play Protect is toggled OFF, that is a massive red flag that someone manually disabled your phone's anti-malware shield to sideload stalkerware. Photograph that screen with a second camera, toggle Scan apps with Play Protect back ON, and run a manual scan.
2. Step 2: Audit Accessibility Services (Where Android Keyloggers Live):
   • Android locks apps inside sandboxes too, so how does an Android stalkerware app read your WhatsApp/Signal chats and record every keystroke you type? By abusing Android's Accessibility API (originally designed to read the screen aloud for visually impaired users).
   • Open Settings -> Accessibility -> look under Downloaded Apps / Installed Apps / Installed Services.
   • What should be here: Unless you personally use a screen reader or password manager autofill via Accessibility, zero unfamiliar apps should have Accessibility turned on. If you see an unfamiliar service named System Update, Sync Service, Security Service, or Device Health with Accessibility toggled ON, photograph it and toggle it OFF immediately.
3. Step 3: Audit Device Admin Apps (Why You Can't Click "Uninstall" on Stalkerware):
   • Stalkerware registers itself as a Device Administrator so that if you try to uninstall it, the "Uninstall" button is grayed out.
   • Open Settings -> Security & Privacy (or Biometrics and Security) -> More Security Settings -> Device Admin Apps (or simply type Device admin apps into the top search bar of your Settings app).
   • Look at every app checked. Only Find My Device (or your employer's work profile app) should be active. If you see a generic-sounding app enabled as a Device Admin, uncheck / deactivate it first, once deactivated here, its Uninstall button in the main App list will unlock.
4. Step 4: Audit Notification Access and Appear on Top (Draw Over Other Apps):
   • Open Settings -> Apps -> Special App Access (on Samsung: Settings -> Apps -> Three-dot menu -> Special access).
   • Tap Notification access (or Device & app notifications): Any app toggled ON here can silently read the full text of every incoming SMS, WhatsApp, Signal, and email notification and even auto-dismiss security alerts before your screen lights up. Turn off anything unfamiliar.
   • Go back and tap Appear on top (or Display over other apps) and Media projection: Stalkerware uses these to capture silent screenshots and overlay invisible keylogging windows.
5. Step 5: Inspect the Complete All Apps List (Sorted by Size or Install Date):
   • Open Settings -> Apps -> See all apps.
   • Tap the Three-dot menu (top right) and select Show system (only after checking the regular user apps list first.).
   • In the regular user app list (with Show system turned OFF), scroll slowly from top to bottom. Stalkerware cannot hide from Settings -> Apps even when it hides its icon from your home screen. Look for any app with:
     • A blank white icon, a generic green Android robot icon, or a gear icon named System Update, Settings, Backup, SyncService, CoreService, or com.android.system.. appearing in the User/Downloaded apps list.
     • Tap the suspicious app -> scroll to the very bottom of its App Info page and read the line: App installed from... Genuine system apps and legitimate apps say Installed from Google Play Store or come pre-installed on the read-only /system partition. If it says Installed from Chrome, Installed from Files / My Files, or Package installer, someone manually downloaded and sideloaded that .APK file onto your phone.
6. Step 6: Check Google Messages for Web and Google Account Activity:
   • Open the default Messages (Google Messages) app on your Android phone -> tap your Profile icon (top right) -> tap Device pairing.
   • If you see any paired computer (Chrome on Windows, MacOS, etc.), someone scanned your QR code at messages.google.com/web and is reading and sending your SMS/RCS texts live from their browser. Tap Unpair all devices immediately.

Phase 3: Checking your Messaging Apps, Home Wi-Fi, and Cellular Carrier Plan¶

Even if your phone hardware is 100 percent clean, an attacker can intercept your communications through three external layers:

1. Audit Every Messaging App's Linked Devices Menu (Takes 60 Seconds)¶

Modern end-to-end encrypted messaging apps allow linking up to 4 or 5 companion desktop browsers or tablets via a quick QR code scan. Check all four of these apps right now: - WhatsApp: Tap Settings -> Linked Devices. Log out of any session you do not recognize. Also go to Settings -> Chats -> Chat Backup and verify whether someone turned on an unencrypted backup to an unfamiliar account, and turn on Two-Step Verification PIN (Settings -> Account -> Two-step verification). - Signal: Tap your Profile Icon (top left) -> Settings -> Linked Devices. Remove any unfamiliar Signal Desktop or iPad instance. - Telegram: Tap Settings -> Devices (Active Sessions). Tap Terminate All Other Sessions if you see any unfamiliar city, PC, or web browser, and check Settings -> Privacy and Security -> Two-Step Verification. - Instagram / Facebook Messenger / Snapchat: Open Settings -> Accounts Center -> Password and security -> Where you're logged in, and log out of all unfamiliar phones or desktop browsers.

2. Understand What Your Cellular Carrier Bill Reveals on a Shared Family Plan¶

If your phone number is on a Shared Family Plan where a spouse, partner, parent, or employer is the Primary Account Holder (or has the login to att.com, verizon.com, t-mobile.com, rogers.com, or vodafone.co.uk): - What the Primary Account Holder Can ALWAYS See on the Carrier Website: - Even without touching your phone, the Primary Account Holder can download the Detailed Monthly Call & SMS Usage Log PDF. While the text content of your SMS messages is usually not shown on standard bills, the carrier log lists every single 10-digit telephone number you called or texted, the exact date and minute of the call/text, and the exact duration of every phone call. - Therefore, if you call a domestic violence hotline, a divorce attorney, a real estate agent, or a friend using a standard cellular phone call on a shared family plan, that phone number will print right on the carrier web portal within minutes. - How to Communicate Privately If You Are Stuck on a Shared Carrier Plan: - Never place regular cellular voice calls or send regular SMS/MMS texts to sensitive numbers from a shared-plan phone. - Instead, calls and messages made inside Signal, WhatsApp, FaceTime Audio, or a web browser over cellular data (especially with a trusted VPN like ProtonVPN or Mullvad active) show up on the carrier bill only as generic encrypted internet data megabytes (15.4 MB Web Data), never revealing who you called or messaged.

Phase 4: Detecting Zero-Click Mercenary Spyware (Pegasus / Predator) for High-Risk Targets¶

If you are an investigative journalist, human rights defender, political dissident, senior government official, defense contractor, or corporate executive and suspect you have been targeted by advanced nation-state mercenary spyware (such as NSO Group's Pegasus or Intellexa's Predator):

1. Why Standard Manual Checks Don't Find Pegasus: Unlike $29/month consumer stalkerware (mSpy), zero-click mercenary spyware does not appear in Settings -> Apps or Accessibility. It exploits zero-day vulnerabilities in iMessage, FaceTime, WhatsApp, or WebKit to execute code directly in system memory (RAM).
2. Immediate Defense 1: Reboot Your Phone Every Single Morning:
   • Research by Amnesty International's Security Lab and Citizen Lab (University of Toronto) revealed that to evade forensic detection on modern iOS devices (where the root file system is cryptographically sealed read-only via Apple's Signed System Volume), modern Pegasus payloads often operate in-memory only (non-persistent).
   • Shutting down and restarting your iPhone or Android completely every 24 hours wipes volatile RAM and forces the attacker to risk firing a brand-new zero-day exploit to re-infect the phone.
3. Immediate Defense 2: Enable Apple Lockdown Mode or Android Advanced Protection:
   • On iPhone (iOS 16+): Go to Settings -> Privacy & Security -> Lockdown Mode -> Turn On Lockdown Mode. Lockdown Mode hardens the device by blocking most message attachment types, disabling complex WebKit Just-In-Time (JIT) JavaScript compilers, blocking incoming FaceTime calls from numbers you have not previously called, and blocking wired USB data connections while locked. (To date, Citizen Lab and Amnesty International have documented that Lockdown Mode successfully blocks known zero-click iMessage exploit chains).
4. How to Perform a True Forensic Check (MVT: Mobile Verification Toolkit):
   • Never pay scam websites or random cybersecurity apps claiming to "scan for Pegasus".
   • Instead, use MVT (Mobile Verification Toolkit), the free, open-source forensic tool created and maintained by Amnesty International (docs.mvt.re). MVT analyzes an encrypted iTunes/Finder backup and sysdiagnose log (or Android adb bugreport) on a Linux or macOS computer against regularly updated Indicators of Compromise (IoCs) (Shutdown.log anomalies, DataUsage.sqlite process ghosts, and malicious domain artifacts).
   • If you are a journalist, activist, or civil society member, you can also request free forensic analysis directly from Access Now's 24/7 Digital Security Helpline (accessnow.org/help) or Amnesty International's Security Lab.

Frequently asked questions¶

Sources checked¶

• National Network to End Domestic Violence (NNEDV, United States): Safety Net Project: Technology Safety & Stalkerware Triage Guidelines for Survivors (techsafety.org).
• Cybersecurity and Infrastructure Security Agency (CISA) & National Security Agency (NSA, United States): Mobile Device Best Practices: Mitigating Spyware, Spear-Phishing, and Zero-Click Exploits (cisa.gov).
• Apple Platform Security & Support (United States): Safety Check on iPhone (iOS 16/17/18) User Guide and Lockdown Mode Technical Specification (support.apple.com/guide/personal-safety).
• Google Safety Center & Android Security (United States): Google Play Protect Stalkerware Detection, Unknown Tracker Alerts, and Accessibility Permission Auditing (support.google.com/android).
• Coalition Against Stalkerware (International): Indicators of Compromise, Forensic Preservation Before Removal, and Survivor Safety Planning (stopstalkerware.org).
• Amnesty International Security Lab & Citizen Lab at the University of Toronto (International): Mobile Verification Toolkit (MVT) Documentation and Forensic Methodology for Detecting Pegasus / Mercenary Spyware (docs.mvt.re, citizenlab.ca).
• National Cyber Security Centre (NCSC) & Refuge Tech Safety (United Kingdom): Guidance on Spotting and Removing Spyware and Securing Shared Accounts (ncsc.gov.uk, refugetechsafety.org).

Related guides¶

• GPS tracker and AirTag stalking
• Smart home hack, camera hijacking, and stalkerware
• Domestic violence
• Domestic violence recovery and safety plan
• Stalking and physical surveillance defense
• Hacked email account: hidden forwarding rules and recovery