Consumer-grade spyware apps that covertly and continually monitor your private messages, photos, phone calls and real-time location are a growing problem for Android users.
This guide can help you identify and remove common surveillance apps from your Android phone, including TheTruthSpy, KidsGuard and other apps.
READ OUR EXCLUSIVE INVESTIGATION
- Fake passports, real bank accounts: How TheTruthSpy spyware made its millions
Consumer-grade spyware apps are frequently sold under the guise of child monitoring or family-tracking software, but are referred to as “stalkerware” and “spouseware” for their ability to also track and monitor partners or spouses without their consent. These spyware apps are downloaded from outside of Google Play’s app store, planted on a phone without a person’s permission and often disappear from the home screen to avoid detection.
Stalkerware apps rely on abusing in-built Android features that are typically used by companies to remotely manage their employees’ work phones or use Android’s accessibility mode to snoop on someone’s device.
You may notice your phone acting unusually, running warmer or slower than usual, or using large amounts of network data, even when you are not actively using it.
Checking to see if your Android device is compromised can be done quickly and easily.
Before you start
It’s important to have a safety plan in place and trusted support if you need it. Keep in mind that removing the spyware from your phone will likely alert the person who planted it, which could create an unsafe situation. The Coalition Against Stalkerware offers advice and guidance for victims and survivors of stalkerware.
Note that this guide only helps you to identify and remove spyware apps, it does not delete the data that was already collected and uploaded to its servers. Also, some versions of Android may have slightly different menu options. As is standard with any advice, you follow these steps at your own risk.
Check your Google Play Protect settings
Make sure Google Play Protect, a security feature in Android phones, is enabled.Image Credits: TechCrunch
Google Play Protect is one of the best safeguards to protect against malicious Android apps by screening apps downloaded from Google’s app store and outside sources for signs of potentially malicious activity. Those protections stop working when Play Protect is switched off. It’s important to ensure that Play Protect is switched on to ensure that it’s working and scanning for malicious apps.
You can check that Play Protect is enabled through the Play Store app settings. You also can scan for harmful apps, if a scan hasn’t been done already.
Check if accessibility services have been tampered with
Stalkerware relies on deep access to your device to access the data, and is known to abuse Android’s accessibility mode which, by design, requires broader access to the operating system and your data for screen readers and other accessibility features to work.
Android users who do not use accessibility apps or features should not see any apps in their Android settings.
If you do not recognize a downloaded service in the Accessibility options, you may want to switch it off in the settings and remove the app. Some stalkerware apps are disguised as ordinary looking apps and are often called “Accessibility,” “Device Health,” “System Service” or other innocuous-sounding names.
Android spyware often abuses in-built accessibility features. Image Credits: TechCrunch
Check your notification access
Much like the accessibility features, Android also allows third-party apps to access and read your incoming notifications, such as allowing smart speakers to read alerts out loud or your car to display notifications on its dashboard. Granting notification access to a stalkerware app allows for persistent surveillance of your notifications, which includes message and other alerts.
You can check which apps have access to your notifications by checking your Android notification access settings under Special app access. Some of these apps you may recognize, like Android Auto. You can switch off notification access for any app that you do not recognize.
Spyware taps into notifications access to read user messages and other alerts. Image Credits: TechCrunch
Check if a device admin app has been installed
Other features commonly abused by stalkerware are Android’s device admin options, which have similar but even broader access to Android devices and users’ data.
Device admin options are usually used by companies to remotely manage their employees’ phones, such as wiping the phone in the event of device theft to prevent data loss. But these features also allow stalkerware apps to snoop on the Android display and the device’s data.
An unrecognized item in your device admin app settings is a common indicator of phone compromise. Image Credits: TechCrunch
You can find the device admin app settings in Settings under Security.
Most people won’t have a device admin app on their personal phone, so be aware if you see an app that you don’t recognize, named something similarly obscure and vague like “System Service,” “Device Health” or “Device Admin.”
Check the apps to uninstall
You may not see a home screen icon for any of these stalkerware apps, but they will still appear in your Android device’s app list.
You can view all of the installed apps in Android’s settings. Look for apps and icons that you don’t recognize. These apps may also show as having broad access to your calendar, call logs, camera, contacts and location data.
Spyware apps are designed to blend in with generic-looking names and icons. Image Credits: TechCrunch
Force stopping and uninstalling a stalkerware app will likely alert the person who planted the stalkerware that the app no longer works.
Secure your device
If stalkerware was planted on your phone, there is a good chance that your phone was unlocked, unprotected or that your screen lock was guessed or learned. A stronger lock screen password can help to protect your phone from intruders. You should also protect email and other online accounts using two-factor authentication wherever possible.
If you or someone you know needs help, the National Domestic Violence Hotline (1-800-799-7233) provides 24/7 free, confidential support to victims of domestic abuse and violence. If you are in an emergency situation, call 911. The Coalition Against Stalkerware has resources if you think your phone has been compromised by spyware.
Read more on TechCrunch:
- TechCrunch launches TheTruthSpy spyware lookup tool
- Behind the stalkerware network spilling the private phone data of hundreds of thousands
- Stalkerware apps PhoneSpector and Highster appear shut down after NY settlement
- How to identify and remove KidsGuard ‘stalkerware’ from your phone
- Spyhide stalkerware is spying on tens of thousands of phones
- Hackers uncover new TheTruthSpy stalkerware victims
- Inside TheTruthSpy, the stalkerware network spying on thousands
- Support King, banned by FTC, linked to new phone spying operation
