What is spyware — and how to find and remove it on your phone or computer

Spyware is software secretly installed on a device to gather information about a person without their knowledge, in NIST's definition. The US FTC counts it among the most common types of malware, alongside viruses and ransomware. It can be built to steal passwords and banking details, to show you ads based on what you do, or — in the case of stalkerware — to let someone you know watch your phone.

How spyware gets onto your devices

• Bundled with other downloads, pirated software or a Trojan that looks like a useful app.
• Through a link or attachment in a phishing message.
• Installed directly by someone with access to your phone — stalkerware. Some stalkerware only works on a phone that has been rooted or jailbroken, the US FTC notes.

What spyware can do

The US FTC lists what stalkerware can do once it's installed: track your location, turn on your microphone, read your texts and emails, see your photos and watch what you do online. Spyware on a computer is more often after passwords and financial details — some of it works as a keylogger, recording everything you type.

Signs of spyware

• Your battery drains faster than usual, or the phone overheats.
• You're using more data than you'd expect.
• The phone turns itself off and on.
• Apps you don't recognise — some spying apps hide under bland names such as "System Service", the US FTC warns.
• On a computer: a sudden slowdown, unexpected ads or redirects.
• Someone seems to know where you've been or what you've said in private.

The US FTC frames these as questions to ask yourself, not proof. Plenty of phones drain their batteries for ordinary reasons.

If someone you know may have installed it

Think about safety before you delete anything. The US FTC warns that removing stalkerware, or changing your phone, could tip off the person who installed it. Reach out for help from a device they can't access — a domestic abuse support service where you live can help you plan. On iPhone, Safety Check (Settings > Privacy & Security > Safety Check) offers Manage Sharing & Access to review who and what can see your information, and Emergency Reset to cut it off at once.

A new phone is the safest option. If you keep the phone, a full factory reset may remove the stalkerware — but don't restore your apps from a backup afterwards: Apple warns that restoring a backup may reinstall the malicious software.

How to remove spyware

• On a computer, follow the US FTC's order: stop logging in to sensitive accounts, update your security software, run a full scan and remove what it finds, then change your passwords and turn on two-factor authentication.
• On Windows, real-time protection in Windows Security watches for viruses, malware and spyware. Under Virus & threat protection > Scan options you can run a full scan or the Microsoft Defender Antivirus (offline scan), which works before Windows loads.
• On Android, make sure Google Play Protect is on (Play Store > profile icon > Play Protect > Settings > Scan apps with Play Protect). It scans the device and may disable or remove harmful apps. Remove apps you don't recognise.
• On iPhone, update iOS, review Safety Check and remove apps you don't recognise. A factory reset without restoring apps from a backup is the last resort.

Mercenary spyware and Lockdown Mode

You may have read about mercenary spyware such as Pegasus, used against specific, chosen targets. Apple says such attacks are rare and that the vast majority of users will never be targeted; it sends threat notifications to people it believes have been. For those few, Lockdown Mode is an optional, extreme protection: Settings > Privacy & Security > Lockdown Mode on iPhone, or System Settings > Privacy & Security > Lockdown Mode on a Mac.

Can antivirus find spyware?

Often, yes — real-time protection is built to catch spyware along with other malware. But the US FTC is candid that malware might go undetected, at least for a while, and on an iPhone no app can scan your other apps at all. Updates, a scan when something feels wrong, and two-factor authentication on your important accounts work together.

If it's stalkerware, your safety comes before the cleanup. If it isn't, a full scan and new passwords usually settle it.