Mobile spyware: What it is and how to protect your phone

Q: What exactly does spyware do to phones?

Mobile spyware secretly collects information from your phone without your permission. It can track your location, read messages, view photos and contacts, record audio, monitor browsing activity, steal passwords, or access notifications. Some spyware collects specific information, while more advanced tools can monitor many parts of your device at once.

Q: Can you tell if there’s spyware on your phone?

Not always. Some signs include unfamiliar apps, unusual permission requests, high data or battery use, changed security settings, or unknown device-management profiles. However, advanced spyware can stay hidden, so these signs don’t always confirm an infection.

Q: Can iPhones and iPads get spyware?

Yes. Although iOS and iPadOS include built-in security protections, spyware can still target these devices through software vulnerabilities, malicious configuration profiles, or physical access. Advanced attacks may work without the user tapping a link or installing an app, so keeping the device updated is essential.

Q: How can you remove mobile spyware?

You can remove some mobile spyware by deleting suspicious apps, removing unknown profiles, updating your phone, and changing your passwords. If you think someone you know installed the spyware, consider whether making changes could alert them before removing anything. A factory reset can remove many common spyware apps, but advanced spyware may need help from a security professional.

Q: Is stalkerware the same as mobile spyware?

No. Stalkerware is a type of mobile spyware, but they aren’t the same thing. Mobile spyware includes many types of threats, while stalkerware is usually used to secretly monitor someone’s phone without their permission.

Q: What should I do if my phone is monitored?

If you think someone is monitoring your phone, focus on your safety first. Use another device to get help, secure your accounts, and review your phone settings when it’s safe to do so. You may need to remove suspicious apps, reset your phone, or replace it.

Mobile spyware secretly monitors and collects information from your mobile device
It may arrive through malicious apps, links, exploits, or physical access
Warning signs can help, but advanced spyware may leave few clues
Quick action can protect your accounts, data, and connected devices

Explore iOS protection

What is mobile spyware?

Mobile spyware is software that secretly monitors activity on a smartphone or tablet and sends the collected information to another person or organization. Depending on its capabilities, it may track your location, read messages, view photos, record calls, activate the microphone, collect passwords, or monitor which apps and websites you use.

Some mobile spyware is hidden inside a malicious app or installed by someone who can physically access the device. More advanced tools can exploit security flaws without requiring the user to install anything or even tap a link. Although highly sophisticated spyware usually targets a small number of journalists, activists, officials, and other high-profile people, more widely available stalkerware can affect anyone. iPhones, iPads, and Android devices have built-in protections, but no device is completely immune, especially when it’s outdated, jailbroken, rooted, or left unlocked.

Stalkerware

Stalkerware is monitoring software installed without the phone owner’s informed consent. It’s often used by someone who wants to secretly track another person’s location, messages, or activity.

Malicious apps

Some apps pretend to offer useful features while secretly collecting recordings, files, messages, locations, or other information beyond what the user expects.

Commercial spyware

Commercial spyware is advanced surveillance software sold to governments or other customers. It’s usually used to monitor specific targets rather than everyday users.

Credential-stealing spyware

This type of spyware focuses on stealing sensitive information, such as passwords, login codes, banking details, and browsing activity. Attackers can use this information to access accounts or steal money.

Remote access spyware

Remote access spyware gives an attacker control over parts of a phone. They may be able to view files, change settings, or turn on features like the camera or microphone without permission.

Learn more about other threats

How does mobile spyware work?

Mobile spyware works by secretly getting access to a mobile device, collecting information, and sending it to someone else. The exact steps depend on the type of spyware, but most attacks follow a similar pattern.

The phone is targeted

An attacker chooses a phone or distributes spyware widely through malicious apps, fake updates, phishing messages, or compromised websites.

Spyware gains access

Spyware can get installed when someone downloads a harmful app, gives an app too many permissions, or clicks a malicious link. Advanced spyware can also exploit security flaws without any action from the user.

Permissions are expanded

The spyware attempts to access sensitive features such as location services, messages, contacts, files, the microphone, camera, notifications, or accessibility controls.

Activity is monitored

Once active, the spyware collects selected information in the background. It may hide its icon, use an innocent-looking name, or disguise its activity as a system process.

Information is transmitted

The stolen data is sent to a remote server or online dashboard controlled by the attacker. They can then view the stolen information, track activity, or use it for other purposes.

What are real-world examples of
mobile spyware?

Mobile spyware ranges from ordinary apps misused for secret monitoring to sophisticated tools built to target specific people. These examples show several ways it can reach a device.

Graphite targets journalists, 2025

In 2025, Citizen Lab confirmed that Paragon’s Graphite spyware had been used to target journalists’ iPhones. Researchers found evidence of a zero-click attack, meaning the victims didn’t need to click a link, open a file, or install an app for the spyware to work. This case shows how advanced spyware can exploit security weaknesses to access a device without obvious signs of an attack.

iRecorder turns malicious, 2023

In 2023, ESET researchers discovered that the Android app iRecorder - Screen Recorder had gained spyware capabilities after an update. The app originally appeared to be a normal screen recording tool, but the malicious version could secretly record audio through the microphone and steal files from affected devices. Before it was removed from Google Play, it had reached more than 50,000 installations, showing how spyware can sometimes hide inside apps that appear legitimate.

SpyFone stalkerware case, 2021

In 2021, the FTC took action against SpyFone, a stalkerware provider accused of secretly collecting people’s location data, messages, photos, and other phone activity. The FTC also found security weaknesses that exposed some of the collected information and banned the company and its CEO from the surveillance business.

What are the risks and impacts
of mobile spyware?

A phone holds conversations, photos, account access, location history, and other deeply personal information. Spyware can expose this information and affect your privacy, security, and safety.

Loss of privacy

An attacker may follow your movements, read private conversations, view photos, or listen to your surroundings without your knowledge or permission.

Account theft

Spyware can steal passwords, login codes, notifications, and browsing activity. Attackers can use this information to access your email, banking, social media, and other accounts.

Financial harm

Spyware may expose payment details or information that supports fraud, identity theft, extortion, or highly convincing scams aimed at you or your contacts.

Personal safety risks

Location tracking and hidden monitoring can put people at physical risk, especially when stalkerware is used as part of domestic abuse, harassment, or coercive control.

Who is most at risk from
mobile spyware?

Anyone can encounter a malicious app or unsafe link, but some people face a higher risk because of their work, relationships, device settings, or access to sensitive information.

People at risk of unwanted monitoring

A current or former partner may have had physical access to the phone, know the passcode, or misuse shared accounts and location services to monitor activity.

High-profile targets

Journalists, activists, lawyers, executives, officials, and political figures may be targeted with advanced spyware because of the information, contacts, or influence connected to their work.

Those using less-secure devices

Phones that are outdated, jailbroken, rooted, or set up to install apps from untrusted sources may be more vulnerable to security issues and harmful software.

People with shared accounts

People who share phones, passwords, Apple Accounts, Google accounts, or family-management access may have a harder time noticing when someone is monitoring their activity without permission.

How can you protect yourself from
mobile spyware?

There is no single setting that stops every form of spyware. Keeping your phone updated, protecting access to your device, and managing your apps and accounts carefully can help reduce the risk.

Install updates promptly

Keep iOS, iPadOS, Android, browsers, and apps updated. Security releases fix vulnerabilities that spyware may otherwise use to gain access to your device.

Protect physical access

Use a strong device passcode and biometric protection. Do not share your passcode, and change it if someone else may already know it.

Review apps and permissions

Check for unfamiliar apps and review which apps can access your location, microphone, camera, photos, notifications, accessibility settings, and device-management features.

Use trusted app sources

Install apps from official stores and verify the developer, reviews, permissions, and purpose. Avoid apps sent through unknown links or websites.

Secure connected accounts

Change passwords if you think they may have been exposed. Use multi-factor authentication, review devices signed into your accounts, and remove access you don’t recognize.

Explore iOS protection

How Intego ONE for iOS helps check your iPhone’s security

Intego ONE for iOS is included in Intego ONE Complete. It doesn’t scan your iPhone for spyware or remove spyware from the device. Instead, it checks important security protections and flags conditions that could leave your iPhone more exposed or require further investigation.

iOS update check

Intego ONE checks whether your iPhone is running the latest available version of iOS, which includes important security fixes.

Jailbreak detection

Intego ONE checks whether your iPhone appears to be jailbroken, which can weaken the built-in iOS protections and increase its exposure to security threats.

Screen recording check

Checks whether an app is recording your iPhone screen, so you can investigate activity you don’t recognize or expect.

Face ID and passcode check

Checks whether Face ID and a device passcode are set up. These protections make it harder for someone with physical access to open your iPhone and change its settings.

Get Intego ONE Complete

Frequently asked questions

What exactly does spyware do to phones?

Can you tell if there’s spyware on your phone?

Can iPhones and iPads get spyware?

How can you remove mobile spyware?

Is stalkerware the same as mobile spyware?

What should I do if my phone is monitored?

Intego

Trusted. Proven. Powerful.

Driven by innovation for over 25 years, Intego has provided advanced cybersecurity solutions built to protect what matters most — your data, your privacy, and your devices.

With award-winning antivirus, firewall, VPN, and system optimization tools, Intego combines powerful defense with the simplicity and reliability Mac and PC users expect.

Get Intego

Get total protection and peak performance for your computer

Buy Intego today