Start your 3-day free trial
Sign up to experience all premium features at no cost.
*Available only to new users. Each user is limited to one trial.
What Is Spyware? Signs, Removal and Prevention
Marcus Reid
October 5, 2026· Updated October 6, 2026· 10 min read
Spyware is software that collects information about you or your device without appropriate awareness or consent. It may record activity, location, communications, or other private data. Stalkerware is a surveillance use case that can involve an abusive partner or another person with physical access to your phone; the FTC describes tools that can monitor messages, calls, photos, location, and more.［1］ Not every privacy problem is an installed spying app.
Someone might instead know your account password, retain a signed-in session, or receive location information through an existing sharing setting. Those paths call for different actions. If changing the device could alert a person who might hurt you, use another trusted device to seek safety advice before removing anything. The safest sequence can be more important than the fastest cleanup.
Key Takeaways
- Separate installed spyware, unauthorized account access, and unwanted sharing before choosing a remedy.
- Battery drain, heat, and data usage are clues, not a diagnosis or proof of who is responsible.
- With possible stalking, assess safety and preserve useful evidence before making visible changes.
- Removing software does not recover leaked information or revoke every account session.
What does spyware collect, and how does it arrive?
The collection depends on the software and the permissions or access it obtains. A program may gather browsing activity, communications, or location rather than performing every kind of surveillance. The FTC notes that stalkerware may be disguised or difficult to notice and that someone with access to your phone could install it.［1］ Avoid assuming an app can access all information merely because it is described as spyware.
Unwanted software can also arrive through misleading downloads or bundles. On a computer, a suspect extension, installed application, or malicious attachment deserves investigation. On a phone, examine installed apps and account or sharing arrangements as separate possibilities. A known app name is not sufficient to establish that its present permissions and use were authorized.
Commercial monitoring products may have legitimate administrative uses under appropriate conditions. That does not make covert use acceptable, nor does the label establish the legal position in every jurisdiction. This guide focuses on restoring your control and safety rather than deciding who is legally responsible.
A Trojan describes deceptive delivery; spyware describes collection. Adware emphasizes unwanted advertising, while a rootkit can conceal malicious activity. A computer worm concerns self-copying propagation. These functions can coexist, but finding one symptom does not identify every component.
Is the problem on the device or in an account?
Start with the information the other person appears to know. Knowledge of your location could come from a sharing arrangement, access to a map account, or installed monitoring. Knowledge of an email message could come from account access rather than malware on the phone. You do not need to identify the cause with certainty before seeking help.
| Possible path | Useful evidence | Recovery task |
|---|---|---|
| Installed monitoring software | App inventory, security detection, permissions | Assess safety, preserve evidence, then remediate the device |
| Account access | Unrecognized sessions, recovery changes, login alerts | Recover the account and review sessions from a trusted device |
| Location or family sharing | Sharing recipients and settings | Plan a safe time to change access; consider whether changes are visible |
| Browser or computer collection | Extensions, recent installations, detection reports | Review the specific component and scan with trusted protection |
No single row excludes the others. An account can remain accessible after you remove an app, and a device can remain compromised after you change a password. Treat a factory reset as a device operation, not a universal privacy reset.
For a more focused phone investigation, the guide to possible phone surveillance develops the symptom checks. Here the priority is choosing the right recovery path across phones and computers without turning every symptom into a spying allegation.
Which spyware symptoms are meaningful?
The FTC includes unusual battery use, data use, and other device behavior among possible clues to stalkerware, alongside a person knowing private information they should not have.［1］ Ordinary updates, weak signal, legitimate location services, and aging batteries can produce similar behavior. A symptom cannot identify an installer or prove intent.
| Observation | What you can conclude | What to avoid concluding |
|---|---|---|
| Battery drains or phone gets hot | A resource-use change needs checking | That spyware is definitely installed |
| Another person knows a private location | An information path deserves investigation | That the phone must be the only source |
| A security tool flags an app | The tool identified a suspicious item | That every account is now safe after removal |
| An unfamiliar account session appears | Account access may be unauthorized | That the device necessarily contains spyware |
| No scan finds a threat | No detection occurred under those conditions | That covert access is impossible |
Keep observations factual: dates, alert text, relevant settings, and detection details. Do not repeatedly confront a suspected person with test information to see whether they react. In a potential abuse situation, that experiment could create danger and still fail to establish the technical cause.
A credible warning of targeted mercenary spyware needs the Pegasus notification and specialist-response path, rather than treating an ordinary scan as proof of no infection.
What is a safety-first spyware removal plan?
Use this sequence flexibly: an immediate safety concern takes priority over a technical cleanup. A work-managed device should go to its administrator rather than receive an unauthorized reset. If you do not have a safe alternate device, a local support organization can help you consider options without assuming your current communications are private.
- Assess personal safety before visible changes. If stalking or abuse is possible, seek guidance using a trusted device the other person cannot access. The FTC warns that removal or other changes may alert an abuser. Its linked domestic-violence resources are US-specific; elsewhere, use a relevant local support service.［1］ Do not treat an instruction to “remove immediately” as universally safe.
- Preserve useful evidence when safe. Record observations, app names, account alerts, and relevant dates before a reset destroys them. An advocate or qualified investigator can advise what evidence matters. Avoid storing the only copy in an account the suspected person can access, and do not delay urgent safety assistance to collect perfect logs.
- Separate account and sharing access. From a trusted device, review sessions, recovery details, and sharing recipients. Plan changes with the safety context in mind. On iPhone with iOS 16 or later, Apple's Safety Check can review or stop supported sharing and access; it is not a malware scanner.［3］ Availability and the exact controls depend on your configuration.
- Check and remediate the affected device. On Android, use Google Play Protect and review its findings and app permissions.［2］ On computers, use updated trusted protection and examine recent installations and extensions. The FTC's general malware guidance recommends updating security software and scanning.［4］ Do not install a cleaner promoted by an infection pop-up.
- Escalate or rebuild when needed. If monitoring remains unexplained, a detection returns, or the device cannot be trusted, seek qualified help. A new device or factory reset may form part of recovery. Preserve necessary data first, and avoid restoring the suspect applications from a backup; the FTC specifically cautions about reinstalling stalkerware with restored apps.［1］
- Recover and verify independently. Change potentially exposed passwords from a trusted environment, enable multifactor authentication, review recovery options, and end unwanted sessions where possible. Reinstall only needed apps from trusted sources. Check both device findings and account access afterward, because success in one layer does not establish success in the other.
A reset does not erase information someone already received. If a private message, document, or location history may have been copied, consider the consequences with an appropriate support person. Avoid promising yourself that one clean screen proves the entire exposure has ended.
How can you reduce repeat exposure?
Keep the operating system and applications updated, use a strong device lock, and protect access to important accounts. Review why each app needs location, microphone, camera, or accessibility access rather than granting broad permissions automatically. Permissions enable capabilities; their presence alone does not prove an application abused them.
Treat physical access and account access as related but distinct risks. A person who knows your passcode may change the device, while someone who knows an account password may obtain information without touching it. A recovery plan should address the access actually relevant to your situation, including recovery contacts and shared accounts when applicable.
Use the digital privacy guide to organize ongoing checks. Once endpoint and account trust are restored, the explanation of VPN protection against hackers clarifies what network protection can contribute. It cannot remove a monitoring app, change a sharing recipient, or revoke a session in someone else's account.
Summary
Spyware recovery starts by identifying the possible information path and the safety consequences of changing it. Preserve evidence when appropriate, deal with accounts and sharing separately, then scan or rebuild the device using trusted help. Verify each layer rather than treating a negative scan or factory reset as proof that all surveillance has ended.
FAQ
Is all spyware stalkerware?
No. Spyware describes unwanted information collection; stalkerware describes a surveillance use case often involving an individual monitoring another person. The personal safety risks require special care, but they do not apply identically to every spyware incident.
Does battery drain prove someone is spying?
No. Battery drain can result from ordinary apps, updates, poor signal, or battery aging. Investigate it alongside actual account alerts, suspicious software, and the information involved. It cannot prove either infection or the identity of an attacker.
Can someone monitor me without installing an app?
Yes. Access to an account or an existing sharing arrangement can expose information without a new spying app on the phone. Review those paths separately; device scanning does not revoke account sessions or change sharing permissions.
Should I immediately uninstall a suspected monitoring app?
Not in every situation. If an abusive person may notice the change, seek safety advice first from a trusted device. Preserve useful evidence when safe; immediate removal can alert someone or destroy information needed for later support.
Does Apple's Safety Check detect spyware?
No. Safety Check on supported iPhones helps review or stop supported sharing and access. It is not a malware scanner and cannot establish that every form of monitoring is absent. Use it as one part of an appropriate safety plan.
Will a reset remove every privacy problem?
No. A reset may help device recovery, but account access, sharing settings, and information already copied need separate consideration. Restoring suspect applications from a backup can also undermine the device recovery you intended.
Can a VPN stop spyware already on a phone?
No. Installed monitoring can collect information at the endpoint, and account access is a separate issue. A VPN does not uninstall the app or recover the account; address those layers directly before relying on network protection.
Disclaimer: This guide explains general security decisions; it is not an individual diagnosis. For a managed device, follow your organization’s incident-response instructions.
Sources
- Stalkerware: What To Know — https://consumer.ftc.gov/articles/stalkerware-what-know
- Use Google Play Protect to help keep your apps safe & your data private — https://support.google.com/android/answer/2812853?hl=en
- Safety Check for an iPhone with iOS 16 or later — https://support.apple.com/guide/personal-safety/safety-check-iphone-ios-16-ips2aad835e1/1.0/web/1.0
- Malware: How To Protect Against, Detect, and Remove It — https://consumer.ftc.gov/articles/malware-how-protect-against-detect-and-remove-it
Sources checked 5 October 2026
