Three questions wearing one costume
Asking whether there is spyware on your phone is really three questions with different answers, different detection methods and different consequences for getting it wrong. Most bad advice blends them. Keep them apart.
- Consumer stalkerware. Installed by someone who had physical access to the device. The EFF Surveillance Self-Defense glossary defines it as "A type of spyware that is marketed and sold to consumers as a way to secretly spy on a phone or computer belonging to one's spouse, partner, or sometimes children." Google's Play Protect malware taxonomy treats it as a formal category: code that "collects personal or sensitive user data from a device and transmits the data to a third party (enterprise or another individual) for monitoring purposes."
- Commodity malware. Criminal software distributed at scale, aimed at nobody in particular. This is what antivirus products and app-store scanning were built for, and the class where a scan result means something.
- Mercenary or state-grade spyware. Apple's threat notification page, published April 23, 2025, separates it from everything above: "Such attacks are vastly more complex than regular cybercriminal activity and consumer malware, as mercenary spyware attackers apply exceptional resources to target a very small number of specific individuals and their devices."
Safety first: read this before you look at the phone
If someone with physical access to your phone may have put monitoring software on it, the safest first step is not a scan. The NNEDV Safety Net project heads its stalkerware page with the words "Safety first." and then: "Before looking for or trying to remove stalkerware, think about your safety. Some people may escalate their abusive behavior when stalkerware is removed. You can talk with an advocate about safety planning."
The Coalition Against Stalkerware uses the same sequencing: "Removing stalkerware or other monitoring detection and/or making significant changes may be detected by the abuser and could increase the abuse and harassment. Only attempt to remove stalkerware if you believe it is safe to do so." It adds: "We recommend creating a safety plan... The plans are dynamic and flexible and should be developed using a safer device and with the assistance of a trusted survivor assistance program."
Kaspersky, a founding partner of that coalition, is blunter on page 12 of its State of Stalkerware 2022 report: "In some cases, the perpetrator is notified if their victim performs a device scan or removes a stalkerware app... Do not try to erase the stalkerware, change any settings or tamper with your phone: this may alert your potential perpetrator and lead to an escalation of the situation." Note the two verbs: NNEDV says removal may cause an abuser to "escalate"; Kaspersky says a scan or settings change may "alert" the perpetrator. Each source chose its own word.
Reading this page on the phone in question may itself be visible. NNEDV again: "If you suspect stalkerware, what you do on your phone could be seen by the other person. For calls or online activity where you want more privacy, use a phone or other device that isn't being monitored. This could be a friend's phone, or a computer at a library, school, or work."
In the United States, the National Domestic Violence Hotline is 800-799-7233, listed on the Coalition Against Stalkerware page for survivors. An advocate can help build the safety plan that belongs before every step below.
Which warning signs are real, and which are weak
The symptom checklist is the most repeated and least useful part of this subject. The organisations that work with survivors rank it low.
Kaspersky lists the familiar warning signs, a fast-draining battery among them, then withdraws most of their weight in the same breath (State of Stalkerware 2022, page 12): "the above indicators are circumstantial and do not indicate the unequivocal presence of stalkerware on the device."
The Coalition Against Stalkerware names what does correlate, reproduced here with the source's own typo intact: "Though 'unusual behaviour' of a device (such as a rapidly draining battery, spikes in data usages...) may be a sign of stalkerware, it doesn't have it be [sic] and some stalkerware runs without any such side-effects. It is thus important to trust your instincts: the most common sign that your activity is being monitored will be because of the abuser's changes in behavior."
NNEDV lands in the same place: "the most common sign that your activity is being monitored will be the other person's suspicious behavior." Someone knowing things they should not know outranks any battery graph.
On device heat
A warm phone is one of the most widely repeated spyware indicators online. None of the authoritative sources reviewed for this guide addresses it, in either direction. That is not a debunking; there is nothing here to debunk it with. Treat it as an unverified folk claim.
Inspecting an iPhone
Configuration profiles. Apple's Personal Safety User Guide, updated October 2025, says to go to Settings > General > VPN & Device Management. Where an unwanted profile is present, Apple's wording stays soft: "If you see a configuration profile installed on your device that isn't supposed to be there, you may be able to delete it, depending on who installed it," and the step is "Select the profile, tap Delete Profile, and follow the onscreen instructions."
Apple never calls an unrecognised profile a sign of compromise. Treating one as worth investigating is this site's editorial judgment, not a claim Apple makes. Published advice routinely upgrades Apple's language here.
Apps and permissions. Apple covers the installed-app list on its review and delete apps page and the privacy controls, including which apps reached for location, microphone and camera, under app privacy features. Looking is passive. Deleting and revoking change the device, which is what the safety block covers.
Inspecting an Android phone
Accessibility services. This is the mechanism that makes monitoring possible without root. Google's developer documentation states that "Accessibility services can perform actions, such as clicking buttons or scrolling lists, on behalf of the user", and that a service declares android:canRetrieveWindowContent="true" "if your service needs to inspect the UI hierarchy (for example, to read text from the screen)." Google's Play developer policy bars the abuse case: "Any use of the Accessibility API that enables an app to autonomously initiate, plan, and execute actions or decisions is strictly prohibited." An app in the accessibility list with no accessibility purpose is the highest-value thing to notice on Android.
Device administrator apps. Device admin registration is what makes an app hard to remove. Google's device administration documentation lists among the available powers the ability to "Wipe the device's data (that is, restore the device to its factory defaults)", and explains the stickiness: "To uninstall an existing device admin app, users need to first unregister the app as an administrator." The settings screen was found documented only in a Pixel help page, labelled "Device admin apps - Find or remove apps that can administer your phone". No generic Android equivalent turned up in this review; on other handsets, look for the equivalently named screen under security settings.
Permission manager. Google documents the per-permission view on its app permissions page. Sorting by permission rather than app shows everything holding microphone or location access.
The tools, and what each one cannot do
Play Protect and mainstream antivirus. Google states that "Google Play Protect checks your apps and devices for harmful behavior". How well that catches stalkerware was tested by EFF with AV-Comparatives, published November 6, 2025, running in August and September 2025 against 17 Android stalkerware samples. Read the base first: 17 specific samples in a controlled test, not a real-world detection rate. Within it, "ESET, Bitdefender, McAfee, Kaspersky: detected all but one sample". The Play Protect figure carries a caveat the testers wrote themselves: "the stalkerware apps were installed by following the instructions provided by the app. This often included disabling Google Play Protect... This would explain why the product blocked only 53% of stalkerware installations." That 53% is depressed by the test method, by the source's own account.
MVT. Amnesty International's Mobile Verification Toolkit is "a collection of utilities to simplify and automate the process of gathering forensic traces helpful to identify a potential compromise of Android and iOS devices." It came out of Amnesty's July 2021 Pegasus forensic methodology report, which Citizen Lab peer reviewed and found "sound". It runs against a device backup or filesystem dump, matched to published indicators of compromise.
Two warnings in MVT's own README get dropped whenever the tool is recommended to the public. First: "MVT is a forensic research tool intended for technologists and investigators. It requires understanding digital forensics and using command-line tools. This is not intended for end-user self-assessment. If you are concerned with the security of your device please seek reputable expert assistance." Second: "Public indicators of compromise are insufficient to determine that a device is 'clean', and not targeted with a particular spyware tool. Reliance on public indicators alone can miss recent forensic traces and give a false sense of security." A clean MVT run is not a clean device. (MVT README)
Network-inspection appliances. Kaspersky's TinyCheck is no longer available: its repository has returned 404 on every crawl checked from late September 2024 onward and is absent from KasperskyLab's current GitHub organisation, leaving only an archived copy. The maintained equivalent is SpyGuard, "a forked and enhanced version of TinyCheck", whose README states its own limit: "Note: SpyGuard is not a forensic tool. Therefore, it might miss malware that does not communicate during the analysis."
Commercial products. iVerify's malware and spyware page states that its "unique, low-level access detects zero-click, fileless, and exploit-based compromise, including known commercial spyware." That is a vendor claim on a marketing page, not an independently verified result.
What to do next, by class
Consumer stalkerware. Go back to the safety block before anything else. The order the advocacy organisations use is safety plan, advocate, then technical action. In the US the hotline is 800-799-7233. The Coalition Against Stalkerware, founded in November 2019 by ten partner organisations, connects the security and advocacy sides of this problem.
Commodity malware. Ordinary scanning tools are on home ground here, and removing something is unlikely to provoke a person. Play Protect and the mainstream products in the EFF and AV-Comparatives test are reasonable starting points, with the sample-size caveat above.
Individually targeted. Apple describes its threat notifications this way: "Although our investigations can never achieve absolute certainty, Apple threat notifications are high-confidence alerts that a user has been individually targeted by a mercenary spyware attack, and should be taken very seriously." A genuine one "will never ask you to click any links, open files, install apps or profiles, or provide your Apple Account password or verification code by email or on the phone", which matters when a message claims to be one. (Apple)
Apple scopes Lockdown Mode, documented January 23, 2026, narrowly: "Lockdown Mode is an optional, extreme protection that's designed for the very few individuals who, because of who they are or what they do, might be personally targeted by some of the most sophisticated digital threats. Most people are never targeted by attacks of this nature." It also closes off the profile route described earlier: "Configuration profiles can't be installed... while in Lockdown Mode."
The honest limits of checking your own phone
Self-inspection catches the sloppy end of the problem. It does not settle the question. Citizen Lab, writing in December 2020 about a suspected NSO Group iMessage zero-click exploit, explained why the hardest cases leave nothing to find: "It is more challenging for researchers to track these zero-click attacks because targets may not notice anything suspicious on their phone."
Kaspersky counted 29,312 unique individuals affected in 2022, and the base matters more than the number: it is drawn from Kaspersky's own product telemetry, not from a population measurement. Kaspersky says so: "the statistics reflect only mobile users using Kaspersky's IT security solutions... the data covers the affected number of Kaspersky users, with the global number of affected individuals likely to be much higher." (State of Stalkerware 2022) A separate Coalition Against Stalkerware figure of close to one million victims globally every year is an estimate with no stated methodology.
The advocacy and forensic sources reach the same conclusion independently. NNEDV: "A trained professional may have to check the device to know for sure." Amnesty, on its own tooling: reliance on public indicators alone "can miss recent forensic traces and give a false sense of security." If the stakes are high, the answer is expert help, arranged from a device other than the one in question.