Commercial spyware on mobile devices: what should security teams do?

TL;DR: Commercial spyware on mobile devices can silently expose communications, credentials, documents, and location data, while tools ranging from stalkerware to zero-click mercenary spyware increasingly target executives, defenders, and ordinary employees alike, according to Jamf. The governance problem is that compromise can look legitimate until collection and exfiltration are already underway.

Editorial analysis by NHI Mgmt Group, based on content published by Jamf: “Commercial spyware: the invisible threat in your pocket”.

By the numbers:

• Malwarebytes recorded a 147% increase in Android spyware detections in the first half of 2025.

Key questions

Q: What should security teams do first when they suspect mobile spyware on a corporate phone?

A: Isolate the device from sensitive work, preserve forensic evidence, and stop trusting any authentication or session activity that originated from it.

Q: Why do mobile spyware infections create identity risk as well as data risk?

A: Because phones increasingly carry the human identity context used for authentication, messaging, location validation, and executive decision-making.

Q: What are the signs that spyware may be running on a mobile device?

A: Common warning signs include unusually high battery drain, unexpected data usage, random beeps, and other strange device behavior.

Practitioner guidance

• Restrict high-risk mobile permissions Limit Accessibility Services, developer certificates, profile installation, and sideloading on managed devices that handle corporate identity or sensitive data.
• Enforce rapid OS update deadlines Set minimum supported OS versions and deadline-based updates so known spyware exploits cannot remain viable for long on corporate phones.
• Triage suspicious devices with forensics Investigate unusual battery drain, data spikes, overheating, and unknown apps as potential spyware indicators before restoring device trust.

Bottom line: Commercial spyware can compromise mobile devices without visible signs, which makes trust in the endpoint itself the real security issue.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →