What Is Stalkerware? Recognizing Spyware Used for Personal Surveillance

Your phone is in your pocket. You haven't touched it in hours. But somewhere, someone may be watching everything you do on it.

That's what stalkerware does. It runs silently in the background, invisible to the person being watched, and hands a complete picture of their private life to whoever installed it. Texts, location, calls, photos, browser history. All of it, in real time.

It's not science fiction. It's commercially available software, often marketed as parental controls or employee monitoring tools. And it's more common than most people realize.

What is stalkerware?

Stalkerware is software installed on a device without the owner's knowledge that allows someone else to secretly monitor their activity. The Coalition Against Stalkerware defines it as tools that "enable someone to secretly spy on another person's private life via their mobile device."

The abuser can remotely access web searches, location data, text messages, photos, voice calls, and more. The key distinction from legitimate monitoring apps is consent. Parental control tools, for instance, are typically disclosed. Stalkerware is not.

Depending on the app, it can capture:

• GPS location tracked in real time
• Text messages and call logs including deleted ones
• Private messages from WhatsApp, Signal, Telegram, Instagram, and more
• Photos and videos stored on the device
• Browser history
• Screenshots taken automatically at intervals
• Front-camera photos triggered remotely

Most stalkerware apps don't appear in the device's standard app list. They hide their icon, run in the background, and send data to the person who installed them without leaving obvious traces.

Who uses stalkerware, and why?

Stalkerware is most commonly used in the context of intimate partner abuse. It gives an abuser real-time visibility into a victim's communications, location, and relationships, which can be used to control, isolate, or threaten them.

But it's not limited to romantic relationships. Parents have used it to covertly surveil adult children. Employers have installed it on personal devices. People with obsessive or controlling tendencies use it on friends, ex-partners, and colleagues.

According to the Kaspersky 2023 State of Stalkerware report, 31,031 unique users were detected with stalkerware on their devices in 2023, up from 29,312 in 2022. The report also found that 23% of people worldwide said they'd encountered some form of online stalking from someone they'd recently started dating.

Those numbers reflect only the cases that were detected. Many more go unnoticed.

How does stalkerware get installed?

This is where most people feel confused. If your phone is always on your person, how does it get onto your device?

In almost every case, stalkerware requires physical access to your phone. Someone who knows your PIN or can unlock your device can install it in a matter of minutes. This is why intimate partners and people living in the same home are so often the perpetrators.

On Android, it's installed directly as an app. It's typically downloaded from outside the Play Store (a process known as sideloading) and configured to hide itself. Jailbreaking isn't the only way an iPhone gets monitored, though. If someone knows your Apple ID password, or the phone is set up on a shared family Apple ID, they can see your location through Find My, your photos through iCloud Photos, and your texts through Messages in iCloud, all without installing anything or jailbreaking the device.

Some abusers hand a target a brand-new phone that's already been set up with stalkerware before giving it as a gift.

Warning signs stalkerware may be on your phone

Stalkerware is built to be invisible. But no software runs without leaving some footprint. These are the signs worth watching for.

Battery draining faster than usual. Stalkerware runs continuously in the background, which consumes power. If your battery life has suddenly dropped without any other explanation, it's worth investigating.

Overheating when idle. A phone that gets warm when you're not actively using it may be running processes it shouldn't be. Constant data transmission is one of the most common causes.

Higher data usage. Stalkerware sends information to an external server. If your monthly data use has spiked and you haven't changed your habits, check which apps are responsible in your phone's settings.

Slow performance. Background monitoring processes take up memory and processing power. A phone that's suddenly sluggish could have more running under the hood than you know.

Unfamiliar apps. Look through your installed apps regularly. If you see something you don't recognize and didn't install, search for it before deleting it.

Phone screen lighting up when idle. If your screen activates on its own without any notifications, a background process may be triggering it.

None of these signs are definitive on their own. But a cluster of them together is a reason to look more closely.

How to check for and remove stalkerware

If you suspect stalkerware is on your device, there are practical steps you can take. Before you start, one important caution: if you're in an abusive situation, suddenly removing the stalkerware may alert the person who installed it. If your safety is at risk, consult a domestic violence resource first, such as the National Domestic Violence Hotline, before making changes.

Step 1: Run a security scan. A reputable mobile security app can detect many types of stalkerware. This is one of the quickest ways to get a clear answer about what's on your device.

Step 2: Check app permissions. On both Android and iOS, go to your settings and review which apps have access to your location, microphone, camera, and contacts. If an app you don't recognize has those permissions, that's a flag.

Step 3: Check for device administrator access (Android). Go to Settings > Security > Device Admin Apps. Stalkerware sometimes grants itself administrator status to make it harder to remove. If you see an app there that you don't recognize, this is a serious warning sign.

Step 4: Factory reset. A factory reset is the most thorough way to remove stalkerware. It wipes the device completely. Back up your personal data first, then restore the device to its original state and set it up fresh. On iOS, go to Settings > General > Transfer or Reset iPhone. On Android, go to Settings > System > Reset options.

Step 5: Change your passwords from a different device. If stalkerware was running, it may have captured your credentials. Change passwords for your key accounts from a separate, trusted device after the reset.

Is stalkerware legal?

The legal picture is complicated. In most countries, the stalkerware apps themselves are sold legally, often marketed as parental control or employee monitoring tools. But installing them on another person's device without their consent is illegal in most jurisdictions.

As the Coalition Against Stalkerware puts it: "Regardless of stalkerware's availability, the abuser is accountable for using it as a tool and hence for committing this crime."

If you believe someone has installed stalkerware on your device, document what you find before removing it. Screenshots of unfamiliar apps or suspicious data usage can be useful evidence if you choose to involve law enforcement.

How to protect yourself going forward

Prevention is simpler than detection. These habits go a long way.

• Use a strong PIN or biometric lock. Physical access is required to install most stalkerware. A lock screen is your first line of defense.
• Don't leave your phone unattended with people you don't fully trust.
• Review app permissions regularly. Both Android and iOS make this easy in settings.
• Check who has access to your Apple ID or Google account, and review Find My family sharing and location-sharing settings. Remove any devices or people you don't recognize or no longer trust.
• Keep your operating system updated. Security patches close vulnerabilities that stalkerware and other malicious software can exploit.
• Use a security solution that blocks threats in real time. Guardio provides real-time protection against phishing sites, malicious downloads, and malicious browser extensions, on both your computer and your phone.

Get a free security scan with Guardio today and stay protected.

Conclusion

Stalkerware is a serious threat precisely because it's hard to see. It's built to be invisible, and in many cases, it works. But the warning signs are there if you know what to look for. A phone that overheats for no reason, data usage that doesn't match your habits, apps you don't remember installing. These aren't minor annoyances. They're your device telling you something's wrong.

If you're worried about your privacy, start with the basics: a strong lock screen, regular permission audits, and a security tool that actively monitors what's running on your device. You don't need to be a tech expert to protect yourself. You just need to know what questions to ask.