Spyware and Stalkerware Guide: Surveillance Software, Signs and Safe Response

Spyware is software installed on a device without the owner's knowledge to collect information about them, and stalkerware is the subset used by one person, often a current or former partner or family member, to secretly monitor another person's phone or computer. Put simply, spyware watches you for someone else's benefit; stalkerware is spyware where that someone knows you personally. NIST's glossary defines spyware as software secretly installed into a system to gather information on individuals or organisations without their knowledge, a type of malicious code. The response to stalkerware differs from ordinary malware clean-up because the person behind it may react to losing access, so safety comes before removal. This guide covers the categories of surveillance software, how they collect data, the signs, a safe response, and the enterprise angle for mobile device management (MDM) and bring-your-own-device (BYOD) programmes. It is for security teams, IT support staff who may be the first person an affected colleague asks, and practitioners who want an accurate, non-alarmist reference.

Key takeaways

• Most stalkerware needs physical access. The Coalition Against Stalkerware notes it usually requires access to an unlocked device, so a short auto-lock and a private passcode are the most effective prevention.
• Safety planning comes before removal. Both the FTC and the Coalition Against Stalkerware warn that removing stalkerware may alert the person monitoring and could escalate abuse; talk to a support service first, using a device they cannot access.
• Removal also removes evidence. Document what you can before a reset if reporting to police or seeking legal protection is a possibility.
• Accounts can be the spyware. Shared cloud accounts, backups, location sharing and known passwords give the same visibility as an app, so account security is part of every response.
• Commercial spyware is a different problem. Mercenary spyware aimed at journalists, officials and executives uses exploits rather than physical access and needs a different playbook; see the Commercial Spyware Guide.

What it is

"Spyware" is an umbrella term. Its categories differ in who deploys them, how they get onto a device and what a defender should do about them.

The Coalition Against Stalkerware, founded in November 2019 by domestic violence organisations and security companies, describes stalkerware as software programs, apps and devices that enable someone to secretly spy on another person's private life. The FTC notes it is designed to hide, sometimes under innocuous names such as "System Service". The defining feature is covert use against another person without their consent, not the product's marketing. For commodity threats see the Mobile Malware Guide and the Infostealer Threat Guide.

How it works

Stalkerware rarely relies on technical exploits. It abuses the access the installer already has: a known passcode, a moment alone with an unlocked phone, or credentials to the victim's cloud account. The Coalition notes that on iPhone and iPad some stalkerware pulls data from iCloud backups rather than running on the device, and the FTC notes that some products require a rooted Android or jailbroken iPhone.

The data collected maps closely to MITRE ATT&CK for Mobile collection techniques:

Commercial spyware sits at the other end: remote exploitation, high cost and very narrow targeting. The Commercial Spyware Guide covers delivery chains, Lockdown Mode, Android Advanced Protection and forensic triage, and this guide does not repeat them.

Why it matters

Stalkerware is a tool of technology-facilitated abuse. It exposes a person's location, conversations and contacts to someone who may already be controlling or harming them, and it exposes everyone they talk to. For an organisation it matters in three ways:

• Employee safety: a colleague may come to IT or security because they suspect their phone is monitored. How that conversation is handled can affect their safety. Staff who handle such requests need a short, rehearsed response and a route to HR and wellbeing support.
• Corporate data: a monitored personal phone that holds work email, chat and authenticator apps leaks business data and MFA codes. Notification access and screen capture can expose one-time codes.
• Monitoring policy: any employee monitoring must be disclosed, proportionate and lawful. Covert monitoring of staff devices is a privacy and legal risk, not a security control.

Signs that may indicate monitoring

The FTC lists device signs such as faster battery drain, unexpected data use, overheating or the phone restarting by itself, and relationship signs such as someone knowing your location, private conversations or contacts without being told, or having had unsupervised access to the phone. The Coalition stresses that some stalkerware causes no visible symptoms, advises people to trust their instincts, and suggests keeping a log of what they notice. None of these signs proves stalkerware; battery and data changes have many ordinary causes. The strongest indicator is someone knowing things they should not.

A safe response, in order

1. Pause before changing anything: removing an app, resetting the phone or changing passwords may alert the person monitoring. The FTC and the Coalition both advise contacting a domestic abuse or victim support service first.
2. Use a safer device: research help and make contact from a device the person has never had access to, such as a trusted friend's phone or a work computer they cannot reach. The Coalition warns that searches for help can be seen on a monitored device.
3. Make a safety plan: a survivor support programme can help build a personal safety plan before any technical change. If someone is in immediate danger, contact the local emergency services.
4. Preserve evidence: save messages, screenshots and a log of incidents before removal, because deleting stalkerware deletes related evidence. If police involvement is likely, the Coalition advises seeking their help first.
5. Check accounts and sharing: review which devices are signed into email, cloud and messaging accounts, location sharing, family sharing and backup settings. On iPhone, Safety Check (iOS 16 or later) is designed to review and change what is shared.
6. Remove when it is safe: the Coalition describes a new phone with new accounts as the most effective option and a factory reset as almost as effective. The FTC advises not restoring apps from a backup, which can reinstall the stalkerware; reinstall only needed apps from the store. Reputable anti-malware apps can detect many stalkerware products.
7. Prevent reinstallation: set a short auto-lock (the Coalition suggests 30 seconds), a passcode the other person does not know, unique passwords with a password manager, two-factor authentication, and keep the OS updated.

Where to get help: the Coalition Against Stalkerware keeps a resources page listing national helplines, shelters, victim support and technology safety organisations by country, plus directories such as WAVE for Europe. Most countries have a national domestic abuse helpline; in the United States the FTC points to the National Domestic Violence Hotline and the NNEDV Safety Net Project. Check current details with the organisation itself.

Common misconceptions

• "An antivirus scan settles it": scanners detect many products, but a clean result does not rule out account-based monitoring through shared cloud logins, location sharing or a known passcode.
• "Delete it straight away": immediate removal is the standard malware instinct and the riskiest move here. Safety planning and evidence come first.
• "iPhones cannot get stalkerware": app-based stalkerware is harder on a non-jailbroken iPhone, but backup and account access achieve similar results.
• "Parental or employee monitoring apps are always fine": the same product used covertly against another adult is stalkerware.
• "Everyone is a target of government spyware": mercenary spyware is expensive and narrowly targeted. For most people the realistic risks are stalkerware, malicious apps and account takeover.
• "MDM lets IT check personal phones for stalkerware": app protection policies on unenrolled BYOD apply only to work apps; IT should not expect, or claim, visibility into personal data.

Related concepts

The enterprise angle: MDM and BYOD

• Corporate-owned devices: full MDM enrolment lets IT enforce passcode length, auto-lock, OS version and block sideloading. ATT&CK Mobile mitigations include Enterprise Policy (M1012) and Use Recent OS Version (M1006). See the Mobile Device Security Guide.
• Personal devices: Microsoft documents that Intune app protection policies work without device enrolment, apply only in the work context, and support selective wipe of company data. They protect work data on a phone that may be monitored, without inspecting personal content. Android work profiles similarly separate work apps. See the BYOD Policy Template.
• Mobile threat defence: MTD agents can flag risky apps, rooting or jailbreaking and outdated OS versions and feed device risk into access decisions. See the Mobile Threat Defense Buyer's Guide.
• Support desk handling: treat a staff member's report of suspected monitoring as a personal safety matter. Offer a clean loaner device, avoid changes on the suspect phone until they decide, and refer to HR, wellbeing and external support services. Do not promise what any service can or cannot keep confidential.

Where identity fits

Much stalkerware is really an identity problem: someone knows the passcode, the Apple ID or Google password, or holds an active session or linked device. After a suspected compromise of a work-connected phone, re-register MFA methods on a clean device, revoke sessions and remove unknown linked devices. Phishing-resistant authenticators resist code interception from notification and screen capture. See the Phishing-Resistant MFA Guide and the Session Hijacking and Cookie Theft Guide.

Detection and measurement

For managed fleets, monitor MDM compliance for rooted or jailbroken status, sideloaded apps, apps holding accessibility or device administrator rights, and OS versions below policy. Useful metrics: percentage of corporate mobile devices compliant with passcode and auto-lock policy; percentage of BYOD users covered by app protection policies; number of devices flagged rooted or jailbroken and time to remediate; share of support staff trained on the safe response steps; mean time to provide a clean loaner device after a report.

Framework mapping

Common failure patterns

• Support staff wiping a colleague's phone on the spot, destroying evidence and alerting the person monitoring.
• Resetting a phone but restoring the old backup, which reinstalls the app.
• Cleaning the device but leaving shared cloud credentials, linked devices and location sharing in place.
• BYOD programmes with no app protection policy, so work email and authenticator codes are readable by any monitoring app.
• Covert employee monitoring deployed as a "security tool" without legal review or disclosure.

Practitioner checklist

• Write a short support-desk procedure for suspected stalkerware: listen, do not change the device, offer a clean device, refer to HR and external support services.
• Train IT, HR and security staff who may receive these reports, and keep a current list of national support organisations.
• Enforce passcode, short auto-lock and current OS on corporate mobile devices through MDM.
• Apply app protection policies to work apps on personal devices, with selective wipe and data transfer restrictions.
• Block sideloading and flag rooted or jailbroken devices in compliance policy and conditional access.
• After a suspected compromise, revoke sessions, re-register MFA on a clean device and remove unknown linked devices.
• Prefer phishing-resistant MFA so captured notifications and screens do not yield usable codes.
• Review any employee monitoring software for disclosure, proportionality and legal basis.
• Route high-risk staff concerned about mercenary spyware to the Commercial Spyware programme, not this procedure.

Standards and references

• NIST: Glossary, spyware
• Coalition Against Stalkerware: What is stalkerware
• Coalition Against Stalkerware: Stalkerware detection, removal and prevention
• Coalition Against Stalkerware: Get help resources
• FTC: Stalkerware, what to know
• Apple: How Safety Check works
• Microsoft Learn: App protection policies overview
• MITRE ATT&CK: Mobile Collection (TA0035)

Related NHI Mgmt Group resources: Commercial Spyware Guide · Mobile Malware Guide · Mobile Device Security Guide · BYOD Policy Template · Malware Guide