A device can appear to work normally while quietly exposing private activity. Spyware may affect computers and phones that run different operating systems, so you do not need to own a certain kind of device to face this risk. Its presence can be hard to spot, and many everyday problems have other causes.
This guide helps you understand covert monitoring, judge possible warning signs, and choose a careful next step. You will learn how to check a device without treating every glitch as proof of an infection. A careful check is more useful than assuming one odd pop-up proves a device is infected.
Key Takeaways
- Spyware secretly gathers information from a device.
- One pop-up, slowdown, or battery change does not prove infection.
- App permissions and account access can reveal useful clues.
- Use a clean device for sensitive account changes if needed.
- Someone close to you may react if they notice changes to stalkerware.
What Is Spyware and How Does It Work?
Spyware is malware that secretly monitors activity on a device and collects information without the user’s consent. Its defining feature is covert data collection, not a particular screen, file, or operating system. A program may work quietly in the background, so normal device use does not rule it out.
In cybersecurity, spyware malicious behavior is one kind of risk within the wider group called malware. NIST’s malware glossary includes spyware among examples of malicious code. The purpose of a program helps distinguish it from other threats, even when their methods overlap.
How spyware moves from entry to data collection
Spyware usually follows three broad stages: infiltration, monitoring and collection, then transmission. Infiltration places the program on a device, sometimes after a user opens or installs something. The next stage watches activity or searches for data the program can reach.
During collection, spyware may gather information allowed by its design and access. It can then transmit that data to another person or system. Some programs send information over a network, while others may store it until a connection becomes available.
The steps do not always look the same. A simple program may record one type of activity, while a more capable one can gather several kinds of data. Its access also depends on the device’s settings and the permissions it holds.
Quiet monitoring can continue even when the device still looks and feels normal to you.
That is why a familiar home screen cannot tell you what a program does in the background. A security scan or settings review may give you more useful clues than appearance alone.
How spyware differs from other malware
Malware is the broad term for malicious software. Spyware is a type of malware focused on secretly collecting information. A Trojan describes a disguise: it looks like legitimate software to encourage someone to install it.
A virus has a different main purpose. It is designed to replicate and spread, while spyware focuses on collecting data. Ransomware typically locks or encrypts files and demands payment for their release.
A Trojan can deliver spyware, but the two names describe different things. One describes how software gets installed; the other describes what it does after installation. One program can fit both labels when it uses a disguise and then secretly gathers information.
| Threat | Main purpose | Typical behavior |
|---|---|---|
| Spyware | Collect information secretly | Monitors activity and sends data |
| Virus | Replicate and spread | Attaches to files or programs |
| Trojan | Appear legitimate | Tricks a user into installing it |
| Ransomware | Demand payment | Locks or encrypts files |
A program can be both a Trojan and spyware if it disguises itself to get installed and then secretly gathers data.
What Information Can Spyware Collect?
The information at risk can range from a saved password to private messages and location history. What spyware can collect depends on its design and access, so one program may see far less than another. Some programs focus on a narrow set of details, while others can reach several parts of a device.
Information tied to accounts and money
Spyware may expose account credentials, including usernames and passwords. A keylogger can capture passwords and messages as you type them. Saved financial details may also be at risk when a program can access the app or page where they appear.
Stolen passwords can help someone take over an account, especially when the same password protects more than one service. Personal data and financial details may also support fraud or identity theft. Even a small amount of personal information can make a scam message feel more convincing.
For example, a scammer who knows your bank, workplace, or recent purchase can shape a message around those details. That extra context may make a fake request harder to recognize. Free VPN privacy and app-permission concerns matter too, since a privacy tool does not shield every kind of personal information.
Messages, browsing, and device activity
Depending on its capabilities and permissions, spyware may collect messages, email, contacts, photos, browsing history, or location. It may also record some activity on a device. A program that cannot reach a certain app or sensor may not collect information from it.
Private communications can expose plans, relationships, or account recovery details. Browsing history can show interests and routines, while location data can reveal where you spend time. These details may be used to target you, impersonate you, or pressure you.
Think about any accounts you used on a device that may be compromised. Password changes made on that same device could be seen if monitoring remains active. Treat any password used on a device that may be compromised as exposed until you change it from a clean device.
What Types of Spyware Should You Know About?
Different spyware types focus on different jobs, from recording typed passwords to redirecting browser searches. The labels describe different collection or concealment behaviors, and one program can combine more than one. Look at what it can do, not just the name on its icon.
Spyware that captures typing or searches files
A keylogger is software that records the keys a person types on a device. It may capture passwords and messages as they are entered. Some keyloggers track only typed keys, while others may pair that record with other monitoring tools.
An infostealer searches a device for information that could help someone access accounts or misuse personal data. The word describes its aim, not one fixed method. What it can reach depends on the software and the access it gains.
These programs can be hard to judge from a name or icon. A familiar-looking utility may still ask for access that does not fit its purpose. Check the program’s behavior and permissions rather than relying on its label.
Spyware that tracks or changes activity
Adware displays ads, and some forms also track activity to target those ads. Not every form of tracking is malicious, but hidden collection or intrusive behavior deserves a closer look. Browser hijackers change browser settings, such as a home page or search engine, and may redirect searches.
Stalkerware is spyware installed to monitor someone without their consent. A person with access to a device may install it, but physical access is not the only way someone can spy. A rootkit hides software or gives it deep access, which can make detection harder.
These terms can overlap. A Trojan may disguise a program, a keylogger may record typing, and a rootkit may hide the same program. The label is useful, but it does not tell the whole story about a program’s actions.
| Type | Behavior | Information or access at risk |
|---|---|---|
| Keylogger | Records typed keys | Typed passwords and messages |
| Infostealer | Searches for useful data | Stored or accessible account details |
| Adware | Shows ads, may track activity | Browsing and ad-related activity |
| Browser hijacker | Changes browser settings | Searches and browser activity |
| Rootkit | Hides software or deep access | System-level access and concealment |
Do not assume a program is harmless just because it displays ads or looks like a familiar utility.
How Does Spyware Get Onto a Device?
A common path begins with something that looks like an ordinary app, attachment, or update. Spyware can reach phones and computers through several routes, including Android, iOS, and Windows devices. Not every route starts with a clear warning or a download you remember.
Deceptive downloads and messages
A phishing email or text may urge you to open a link or attachment. The message can pretend to come from a delivery service, employer, or familiar contact. A fake app may also copy the name or look of a trusted service.
Unofficial downloads can carry unwanted programs, and software bundles may add extra software during installation. The extra program may be easy to miss if you move quickly through setup screens. An update advertised in a pop-up can also lead to a harmful download.
These approaches rely on confusion or a rushed choice, not a lack of care. A message may look routine, and an app may seem useful. Taking time to check where a file came from can help you spot a mismatch.
Exploits, extensions, and physical access
A compromised website or malicious browser extension may expose a device to harmful software. A vulnerability is a weakness in software that an attacker may exploit. Some attacks can target a device without a user knowingly installing a program.
Stalkerware may be installed by someone who can handle a phone, but physical access is not the only route to spying. Account access, malicious links, or a software flaw may create other paths. Different routes can affect different devices and operating systems.
- Phishing links or attachments in email and text messages
- Fake or unofficial apps downloaded outside trusted stores
- Bundled downloads that add software during setup
- Compromised websites or malicious browser extensions
- Exploited software flaws in apps or operating systems
Before opening an unexpected attachment, verify its purpose through a separate trusted channel.
What Can Spyware Do to You and Your Device?
The main risk is not only that information is collected, but that someone may use it to access accounts or impersonate you. Exposed credentials can lead to account takeover, fraud, or identity theft. The harm can spread when one stolen detail helps unlock another account.
A person who gains access to your accounts may send convincing messages in your name. Personal details can also help someone create targeted phishing attempts. A message that refers to a real account or contact may seem more trustworthy than a generic scam.
Spyware can affect the device itself, too. It may use battery, storage, or network resources, disrupt browsing, or make a system unstable. Slow performance or crashes can have many causes, so those changes alone do not prove spyware is present.
Phone-number fraud is a separate threat from spyware. In a SIM-swap or port-out scam, someone may gain control of your number, texts, and calls. The FCC’s cell phone fraud guidance explains that scammers may use that control to try resetting account credentials.
That route can put accounts at risk even when no spyware is on your phone. Your carrier controls number transfers, while device scans look for software threats. Protecting a phone number with your carrier is a separate security step from scanning a device for spyware.
What Are the Signs of Spyware?
A sudden browser redirect or unknown program is worth checking, but it cannot confirm spyware by itself. Several persistent changes are more concerning than one isolated symptom. Look for patterns across the computer, browser, accounts, and network activity.
Changes to computer and browser behavior
A computer may slow down, crash, or show repeated pop-ups for many reasons. Spyware is one possible cause, but low storage, a faulty update, or a worn battery can also change how a device behaves. Check whether the problem began after a new app or setting change.
An unexpected home page or search engine can point to a browser change. Unfamiliar programs or extensions deserve a closer look, especially when you do not remember adding them. Persistent ads may come from adware, but ads alone do not show that someone is spying.
Try to notice whether changes happen together. A new extension and repeated redirects may be more useful clues than a single slow day. Write down what changed and when, rather than guessing about the cause.
Clues in accounts and network activity
Unusual network activity may have a simple cause, such as an app syncing files. Account alerts can be more telling when they show a login, password reset, or device you do not recognize. Review the alert details before deciding what happened.
Use this checklist to sort out changes that may need a closer review:
- Unexplained slowdown that continues after a restart
- Repeated pop-ups that return after closing the browser
- Browser redirects to a page you did not choose
- Unfamiliar software or extensions on the device
- Unusual network or account activity you cannot explain
No single item confirms spyware, and ordinary software problems can create similar signs. Several lasting changes across different parts of a device deserve more attention than one brief glitch. Record when a persistent change began so you can compare it with a recent installation or account alert.
How Can You Detect Spyware on Android?
On Android, begin by checking which apps are installed and whether their permissions make sense for what they do. Google Play Protect is a useful first check, not proof that every threat is gone. Review the app’s access as well as any scan result.
Review apps and permissions
Open Settings and review the installed apps. Menu names can differ by phone maker, but App settings or Apps usually shows the list. Look closely at programs you do not recognize or no longer use.
Review permissions for sensitive access, such as location, microphone, camera, contacts, and accessibility services. Compare each permission with the app’s stated job. A permission change can have a routine cause and does not, by itself, prove an infection.
Battery and mobile data use can add context. A program using far more power or data than expected may deserve a closer look, though background sync can explain some activity. Check more than one setting before drawing a conclusion.
Run Google Play Protect
Open the Google Play Store, tap your profile icon, then choose Play Protect. From there, you can review the security status and start a scan. If Play Protect warns about an app, read the alert and follow its instructions to disable or remove the app.
Google Play Protect is on by default, and Google recommends keeping it on. It checks apps before download and scans the device periodically, including apps installed outside Google Play. It may warn about, disable, or remove harmful apps.
Google says Play Protect scans Android apps every day and checks 200 billion Android apps daily. On Android versions 6.0 through 10, it may reset permissions for apps unused for three months. It may also block an unverified app that seeks sensitive permissions often targeted in financial-fraud scams.
Play Protect’s default-on setting adds a useful layer of protection, but no tool can establish that every possible threat is absent. A warning deserves attention, while a clean scan does not settle every question. Keep Google Play Protect enabled and investigate any app requesting sensitive access without a clear reason.
How Can You Detect Spyware on an iPhone?
An iPhone user can review sharing and account access with Safety Check in Settings. Safety Check can review who and what has access to your information. Choose the review that fits your situation, because stopping all sharing differs from changing access one item at a time.
Review sharing and account access
Safety Check is available in Settings on iPhones running iOS 16 or later. Open Settings, tap Privacy & Security, then tap Safety Check. Emergency Reset can immediately stop sharing information with all people and apps.
Manage Sharing & Access lets you review and change access for individual people and apps. Safety Check can also review connected devices, reset app privacy permissions, and help you change your iPhone passcode or Apple Account password. These tools help you inspect access, but a settings change does not prove spyware was present.
Review the devices connected to your Apple Account and remove any you do not recognize. Check app privacy permissions too, especially for access that does not fit an app’s purpose. If another person may monitor your phone, consider the possible effect of visible changes before making them.
Respond to an Apple threat notification
An Apple spyware threat notification is different from an ordinary pop-up or unexplained battery drain. Apple uses these alerts to tell users it detected a mercenary spyware attack targeting their iPhone. Treat the warning seriously and read the security guidance Apple provides.
The alert is not the same as a general sign of trouble. A slow phone or unfamiliar app cannot establish that a mercenary spyware attack occurred. Apple’s notification describes a specific threat assessment, so do not dismiss it as a routine device warning.
Use a device you trust to review the guidance if you have concerns about the iPhone’s safety. Avoid making a rushed change that could affect your access or privacy. If an Apple spyware threat notification appears, follow its security guidance rather than dismissing it as a routine warning.
How Can You Detect Spyware on Windows 11?
Microsoft Defender Offline is useful when a deeper scan may be needed because it runs outside the normal Windows kernel. The offline scan can look for malware such as rootkits that may evade the usual Windows environment. Plan for a restart before you begin.
Run Microsoft Defender Offline
On Windows 11, open Windows Security and choose Virus & threat protection. Select Scan options, then Microsoft Defender Offline scan. Save your work before starting, because Windows restarts the device when the scan begins.
The scan takes about 15 minutes and restarts the device when complete. It starts Windows in a trusted environment outside the normal kernel, which helps check for malware that can hide during regular use. After the restart, review Windows Security for the scan result.
Microsoft Defender Offline is available through Windows Security on Windows 11 and Windows 10 version 1607 or later. It does not apply to ARM versions of Windows 10 or Windows 11. Check that your device and version support the scan before you rely on this option.
Check recovery and BitLocker requirements
Windows Recovery Environment must be enabled for the offline scan to run. If it is disabled, the scan may not start, and Windows may show no error message. That can make a failed scan look like nothing happened.
BitLocker protects data on a drive, but the restart may prompt you for its recovery key. Suspend BitLocker protection on the system drive before the scan, or make sure you can reach the recovery key. Losing access to that key can delay getting back into Windows.
Do not interrupt the restart just because the screen changes. Let the scan finish, then review the result after Windows starts again. Before starting, confirm Windows Recovery Environment is enabled and have access to the BitLocker recovery key or suspend protection.
How Do You Remove Spyware Safely?
If spyware may be collecting information, stop using the affected device for sensitive logins until it has been checked. Use a separate clean device to secure accounts that may be exposed. Start with the steps that protect access, then decide whether the affected device needs a reset.
Scan, remove, and secure accounts
Trusted security software can detect and remove many known threats. A scan cannot guarantee that every infection is gone, so treat a clean result as one useful check rather than a final answer. Follow the tool’s instructions if it identifies suspicious software.
Change important passwords from a separate device you trust. Enable multifactor authentication, or MFA, on accounts that offer it. MFA asks for another proof of identity along with a password, which can make a stolen password less useful.
Use this table to choose a response based on what you find and how the device behaves:
| Action | When to use it | Key caution |
|---|---|---|
| Scan and remove suspicious software | A trusted tool finds a threat | A clean scan cannot rule out every threat |
| Change exposed passwords | Accounts were used on the affected device | Change them from a clean device |
| Reset or reinstall | Problems persist after removal | A backup may restore spyware |
Change the email password first from a clean device because email often controls password recovery for other accounts.
When a reset or reinstall may be needed
A factory reset may remove installed apps and settings from a phone. Reinstalling a computer’s operating system may help when an infection persists. These steps can also erase personal files, so keep needed data safe before proceeding.
Restoring everything from a backup can bring the problem back. A backup may include apps or settings that reintroduce stalkerware, especially if you restore the same setup without checking it. Choose what to restore with care.
If a reset does not solve the issue, a trusted technician or the device maker may help you review the next step. Keep proof of ownership and any recovery information close by. A reset is a stronger action, not a promise that every account or device is secure.
How Can You Prevent Spyware?
Keeping operating systems and apps updated closes known security gaps that spyware may exploit. Automatic updates help install fixes as vendors release them. Trusted sources matter too, since a fake update can create the very risk you are trying to avoid.
Reduce risky downloads and permissions
Build these habits into routine device use:
- Enable automatic updates for operating systems and apps.
- Use official app stores and trusted publisher websites.
- Check the permissions requested by apps and browser extensions.
- Avoid unexpected links and attachments in email or text messages.
- Use unique passwords and enable MFA for important accounts.
Official vendor websites are safer places to get updates than email links or ads. CISA recommends automatic updates when available and direct downloads from trusted vendor sites. An ad that looks like an update may lead somewhere else.
App permissions deserve a quick check before and after installation. A flashlight app, for example, may not need access to your contacts or location. Browser extensions also deserve attention because they can read or change browser activity.
Keep devices and accounts protected
Use a different password for each important account. If one service is exposed, unique passwords make it harder to reuse that password elsewhere. MFA adds another check when someone tries to sign in.
Software that has reached end of life no longer gets security updates from its maker. Unsupported software can leave known vulnerabilities unpatched, giving attackers more time to exploit them. CISA recommends retiring products that have reached end of life.
A VPN can protect traffic routed through its connection, but it does not stop phishing, harmful downloads, or account identification. Review privacy terms and app permissions before trusting a VPN with your activity. You can compare free VPN privacy and security limits while keeping those limits in mind.
Do not rely on an old program just because it still opens. Remove or replace software that no longer receives security updates instead of relying on an unsupported system.
What Should You Do If You Suspect Stalkerware?
If someone close to you may be monitoring your phone, your immediate safety matters more than proving the software is there. Use a device the suspected person has never accessed to seek help. Even a check or call from the monitored phone may alert them.
Put personal safety before device checks
Checking a phone, changing settings, or calling for help can alert the person who installed stalkerware. The FTC advises using a device that person has never accessed to seek information or make calls. Choose a safe place and trusted contact before changing the phone.
Stalking affects many people, though measures of stalking and spyware do not count the same thing. The Bureau of Justice Statistics estimated that about 3.4 million people age 16 or older experienced stalking in 2019. A 2023 Kaspersky study detected stalkerware on more than 31,000 unique devices in one year.
Apple Safety Check can help you stop sharing with people and apps on an iPhone running iOS 16 or later. Emergency Reset stops sharing right away, while Manage Sharing & Access lets you review access individually. A sudden change may be visible to someone monitoring you, so weigh that risk first.
Plan a reset or new phone carefully
A factory reset or a new phone may be an option, but a backup can restore stalkerware with other apps. The FTC also recommends checking whether a suspected device has been jailbroken or rooted. Those changes can make it easier to install or hide software.
Apple sent spyware threat notifications to users targeted in 110 countries in August 2026 and had notified customers in over 150 countries to date. The alert says Apple detected a mercenary spyware attack targeting the user’s iPhone and recommends steps to protect the device and data. Apple advises notification recipients to consider Lockdown Mode.
Do not make a visible change to a phone if that change could put you in danger.
Seek help from a safe device before changing a phone that the suspected person may still be monitoring.
Conclusion
Spyware is easier to address when you treat unexpected changes as a reason to check, not as proof or a reason to panic. A single symptom can have an ordinary cause, while a few connected clues may justify a closer review. Choose a response that fits your device and your personal safety.
If no one else may be monitoring you, review app access or turn on trusted software updates. If someone close to you may be involved, use a device they cannot reach before making changes. Choose one safe next step today: review access, update a trusted device, or seek help from a device the suspected person cannot reach.
FAQ
Can someone spy on your phone without having your phone?
Yes, remote software flaws or access to your accounts and shared services can expose information without current physical access. Stalkerware is often installed by someone who had the phone, but that is not the only route to spying. A person who controls an account may see synced messages, photos, or location details through another device.
What is the best way to avoid getting spyware on a machine?
Keep software updated, use trusted download sources, avoid unexpected links and attachments, and use reputable security software. These steps reduce common risks, though none can promise complete protection. Check permissions before installing an app or browser extension, and remove software you no longer use.
Can you detect spyware?
Yes, trusted security scans and checks of apps, permissions, and account activity can find warning signs. No single symptom or scan proves that every threat is absent. A clean result is helpful, but it does not confirm that every part of a device and every account is safe.
How can I tell if someone is spying on my phone?
Review unfamiliar apps, permissions, sharing access, and devices connected to your accounts. Battery drain or high data use alone does not prove spyware, since normal apps can use both. If someone you know may be monitoring you, use a safe device first before changing settings or calling for help.
What is the code to check if someone is spying on my phone?
There is no universal dial code that reliably detects spyware. Phone codes may show limited carrier or call settings, but they cannot scan apps or confirm what software is on a device. Review your phone’s settings and use a trusted security scan instead.
Can I run a test to see if my phone is hacked?
A trusted security scan plus a review of apps, permissions, account sessions, and unexpected settings is a useful check. No single test can rule out every compromise. If a scan finds something, follow its guidance and secure exposed accounts from a separate device you trust.
Is spyware a virus?
No, spyware is a type of malware, but it is not the same as a virus. Spyware mainly collects information covertly, while a virus is designed to replicate and spread. One device can face either threat, or both, so a security check should look for malware broadly.
