Android App Security · Spotting Bad Apps · Lesson 3 of 5

Stalkerware

Spy apps installed by someone you know, and why removing them takes care.

Spying from close by

Most malware comes from strangers who want money. Stalkerware is different. It's software that lets another person, often a partner, ex or family member, secretly watch what you do on your phone. Depending on the product, it can report your location, messages, call logs, photos and browsing, sometimes in real time, to a website the other person logs into.

Because it's aimed at one particular person, it usually isn't spread with fake texts or store listings. The usual route is physical access: someone who knows or guesses your unlock code picks up your phone for a few minutes, allows installs from unknown sources, installs the app, grants it powerful access, and hides it. Common choices are accessibility, notification access and device admin, an older kind of access that can make an app harder to uninstall. Some products are sold openly as "monitoring" tools and pretend they're only for parents.

Google Play bans apps that track people secretly. Its policy allows monitoring features only in apps built and marketed for parents watching their children or for companies managing work phones. Those apps must show a persistent notification while they run and a clear, unique icon, and they can't hide what they do. The policy says they can't be used to track another adult, such as a spouse, even with that person's permission. Hidden spy apps are therefore installed from outside Play.

Spying doesn't always need an app. If someone knows your Google account password, they may see your location history, photos or backups from their own device. Location sharing turned on long ago, or a shared family account, can leak just as much. That's why checking your accounts matters as much as checking your apps.

Signs, and removing it safely

Stalkerware is built to stay quiet, so it can be hard to spot. The Coalition Against Stalkerware, a group of security companies and survivor support organizations, notes that battery drain or extra data use can be a sign, but many products show neither. Its strongest sign is simple: the other person knows too much about your messages, plans or whereabouts, with no other explanation.

Other things worth checking:

• Apps you don't recognize, especially ones with generic names like "Sync" or "Services"
• Unknown apps listed under accessibility, notification access or device admin
• Install unknown apps turned on for a browser or file manager you didn't change
• Google Play Protect turned off without your knowing

Here's the part that surprises people: removing stalkerware can be dangerous. The person watching may notice the reports stop, and the Coalition warns this can increase abuse and harassment. Deleting the app also deletes evidence you might need for a police report or a protective order.

So the safer order is to make a safety plan first. A safety plan is a set of steps for staying safe, ideally made with a trained advocate from a survivor support program. Do the planning on a device the other person has never touched, such as a friend's phone or a library computer, because a watched phone could reveal the plan. In the US, the National Domestic Violence Hotline (1-800-799-7233) can help, and stopstalkerware.org lists organizations in other countries. If someone is in immediate danger, contact local emergency services.

When it is safe to act, the cleanup steps in the next module apply, along with changing your account passwords from a clean device.