How to Detect and Remove Spyware from Android

[Security]

What is spyware and why is it ​

Spyware is malicious software designed to covertly collect information about the user and their device. Its primary purpose is to gain access to valuable data and transmit it to attackers. Depending on the type of threat, spyware can perform various functions:

• record keystrokes;
• collect saved passwords;
• track user actions in the browser;
• access messages and calls;
• control the location of the device;
• collect files and documents;
• use a microphone or camera for covert surveillance.

The main danger of spyware is that the user may remain unaware of the infection for a long time. During this period, attackers gain access to accounts, financial services, and corporate data.

In 2026, hybrid threats will become increasingly common. They combine the functions of spyware, infostealers, and remote control tools. Such programs are capable of not only collecting information but also executing operator commands on the infected device.
Spyware tries to remain unnoticed, but it's not always possible to completely conceal its presence. Typically, an infection is accompanied by a number of indirect signs that may indicate a device compromise.
On smartphones and tablets, spyware often manifests itself through increased background activity. The most common signs are:

• noticeably accelerated battery discharge;
• overheating of the device without high load;
• a sharp increase in mobile traffic consumption;
• the appearance of unknown applications;
• unusual requests for access to the microphone, camera or messages;
• spontaneous activation of accessibility services;
• pop-up notifications from unknown services;
• decrease in overall performance of the device.

Each of these symptoms alone does not indicate infection. However, if several symptoms are observed simultaneously, a more thorough examination of the smartphone is warranted.
On Windows computers, signs of spyware may be less obvious. Many modern threats intentionally limit resource consumption to avoid user attention. However, the following signs should raise concern:

• constant background load on the processor;
• unknown processes in task manager;
• high network activity in idle mode;
• the emergence of new programs without user participation;
• changing browser settings;
• suspicious tasks in startup;
• unexplained requests for privilege escalation;
• slowdown of the system.

Similar symptoms may be associated with other problems, but they are sufficient grounds for diagnosis.

On Android, one of the main indicators of spyware is suspicious permissions. For example, if a game, calculator, flashlight, or app, disguised as a system update, requests access to SMS, geolocation, camera, microphone, or accessibility features without an obvious need.

It's also worth paying attention to unknown apps in the device settings. They may not appear on the home screen, but remain installed and running in the background.

Indirect signs include accelerated battery drain, overheating, freezing, and increased mobile data consumption, especially when the user isn't actively using the device.

On Windows, warning signs include unknown startup programs, suspicious services, and scheduled tasks that launch files from temporary folders. Sometimes spyware can also reveal indirect symptoms, such as the camera or microphone being occupied by an unknown process. Another telltale sign is regular network connections to unfamiliar addresses unrelated to the usual services.

Typically, a combination of several indicators allows for early detection of spyware. Therefore, it's worth checking not just individual symptoms, but the overall behavior of the device.
It's best to conduct the scan in stages. It should include not only a search for suspicious apps but also an analysis of permissions and network activity.
Open the list of installed apps and scroll to the bottom—spyware often hides among system utilities where the user rarely looks. Pay particular attention to:

• programs that you did not install;
• applications without a clear purpose;
• services with system names;
• programs without icons;
• recently installed applications whose origin is unknown.

Detection of a suspicious program does not necessarily mean infection, but such an object requires additional verification.
Open the permissions section in your device's settings and check each app individually, rather than the overall list. This makes it easier to spot apps that don't actually need the requested access. You should especially carefully check apps that have access to SMS, call logs, contacts, microphone and camera, geolocation, and accessibility services.

If a flashlight or calculator app requests access to messages and calls, this is a serious reason to investigate.
Check your battery usage and data usage statistics for the last 3-7 days. This period is long enough to spot any anomalies. Focus not on the actual drain, but on the app causing it. If it's an obscure app with background activity, it's worth checking it separately.
A manual scan should be supplemented with a full device scan. Antivirus software can detect many common spyware families, but it's important to understand its limitations. Some modern threats exploit legitimate system functions and are not detected by classic signature-based detection mechanisms. This is why experts recommend combining automatic scanning with manual device analysis.
Scanning Windows is usually more difficult than diagnosing Android. This is because modern spyware actively uses persistence mechanisms and can automatically launch after every system reboot.
Open Task Manager and examine the list of running processes in the "Details" tab. This makes it easier to spot unfamiliar programs than going through each system partition individually. For a complete picture, you should also check:

• unknown processes;
• applications with high resource consumption;
• programs without digital signature;
• processes with suspicious names.

If a suspicious process is detected, it is worth further checking its location and origin.
One of the first steps in the audit is to analyze the automatic startup mechanisms. To do this, it is necessary to check:

• Windows startup section;
• task scheduler;
• system services;
• entries in the registry.

The detection of an unknown startup item requires further analysis.
Open Task Manager or a third-party network monitor and sort processes by traffic volume. This will quickly show which programs are transferring data, even if the device appears idle. Pay attention to:

• unknown network connections;
• regular visits to suspicious addresses;
• system activity during idle period;
• processes with constant outgoing traffic.

This analysis allows us to identify threats that haven't yet been detected by antivirus software. However, it's important to consider one particular characteristic of modern attacks: not all spyware samples are detectable by standard security tools.

Antivirus software works well when there's a file with a known signature. But modern spyware is increasingly finding such scenarios. There are several situations in which standard antivirus protection is no longer sufficient:

- Commercial mobile spyware (Pegasus, Predator, Graphite). Such programs exploit zero-click vulnerabilities and, due to the specifics of Android and iOS, can appear to antivirus software as legitimate system components.

- Fileless attacks and living-off-the-land techniques in Windows. If malicious code operates through the registry, WMI, or legitimate tools like PowerShell, the antivirus simply has nothing to scan: the file doesn't exist on disk.

- Self-removing stealers. They steal credentials in seconds and delete themselves, leaving virtually no trace in the system.

In such cases, only manual analysis is effective: checking logs, WMI subscriptions, services, loaded DLLs, and network traffic. For mobile devices, specialists also use the Mobile Verification Toolkit, a forensic analysis tool for Android and iOS devices using known indicators of compromise.

Experience shows that a combination of automated tools and manual verification significantly increases the likelihood of detecting complex threats.
Once a suspicious app is detected, it's important to proceed consistently. Attempting to delete individual files without understanding how the threat operates could result in the malware reappearing after a device reboot.
First, you need to remove all programs whose origin is questionable. To do this:

• open the list of installed applications;
• find a suspicious program;
• check the issued permits;
• Perform the uninstallation through system settings.

If the app doesn't uninstall using the standard method, it's worth checking whether it has gained device administrator rights. After uninstalling, it's recommended to restart your smartphone and recheck the list of installed apps.
Many modern spyware samples exploit Android's system mechanisms to gain a foothold. Particular attention should be paid to:

• device administrator rights;
• accessibility services;
• permissions to install applications from unknown sources.

If a suspicious application has received one of the listed accesses, you must first revoke the corresponding permissions and then uninstall it.
After removing the program, we recommend performing a further scan of your device using a security solution. A rescan ensures that no related components or additional modules installed by the malware remain on the system.
If signs of infection persist or there is a suspicion of deep device compromise, a full reset of the smartphone remains the most reliable option. Before performing this procedure, it is necessary to back up important data and ensure that the backup does not contain malicious apps.

A full reset is not always necessary, but it is often the most reliable way to remove persistent spyware.
Cleaning Windows is usually more difficult than removing spyware from a smartphone. This is because spyware can use multiple persistence mechanisms simultaneously. Therefore, removal should involve not only uninstalling the suspicious program but also scanning the system for traces of its activity.
It's worth starting with an analysis of the list of installed software. Carefully examine the following:

• recently installed applications;
• programs from unknown developers;
• utilities that the user did not install themselves;
• Software without a digital signature.

After removing suspicious components, it is recommended to restart your computer.
Even after deleting the main file, some threats retain automatic launch mechanisms. It's important to check:

• "Startup" section;
• task scheduler;
• system services;
• startup folders;
• Windows registry keys.

If the persistence mechanism is left unattended, the malicious component may reappear the next time the system is started.
After manual cleaning, a full system scan should be performed. To improve the scan's effectiveness, it is recommended to use:

• built-in Microsoft Defender;
• specialized anti-spyware solutions;
• additional scanners on request.

Combining multiple tools can increase the likelihood of detecting hidden threat components.
If the device was used for banking services or corporate systems, it's often safer to immediately perform a clean reinstallation of Windows. While this approach takes time, it virtually eliminates the possibility of hidden spyware components remaining.
Modern spyware is dangerous not only because of its data collection but also because of its ability to persist in the system. Even after deleting core files, the malware can attempt to re-establish its presence. Android and Windows use different mechanisms for this, but the goal is always the same: to automatically launch after a reboot.

operating system	What do attackers use?
Android	Accessibility Services Device administrator rights Automatic background launch Disguise as system applications
Windows	Task Scheduler System Services Registry Startup Keys WMI Events Injection into Legitimate Processes

This is why simply deleting a malicious file is usually not enough. In practice, persistence methods can be much more complex than they initially appear, and vary depending on the platform and the techniques used by the attackers.

On Android, attackers most often disguise spyware as system or popular apps—fake messaging apps, banking apps, system updates—that are distributed via SMS phishing or third-party websites. For example, in the Morpheus attack, the victim's mobile data was disconnected and an SMS was sent asking them to install a "connection recovery app"—in reality, it was a spyware. The key persistence mechanism remains the abuse of the Accessibility permission: it allows reading screen contents, intercepting keystrokes, and interacting with apps with virtually no restrictions and without root access. After obtaining the necessary permissions, a spyware like Morpheus enables Wireless Debugging, connects via ADB, and establishes a persistence that survives device reboots, and device administrator rights make it virtually impossible to remove. The final step is disabling security mechanisms: Google Play Protect, popular antivirus programs, and the device's built-in security.

On PCs, rootkits remain the primary and most dangerous method. They infiltrate the operating system kernel, intercept antivirus requests, and hide their presence so deeply that detection requires low-level memory analysis with specialized equipment.

A more common, but no less effective, method is to use the Task Scheduler: the malware creates an autorun task that restores it even after the main file is deleted.

Autorunning through the Windows registry and system services remains the classic method. This is how most spyware is installed. To evade the user and antivirus software, many malware programs use process injection, injecting their code into a trusted process, such as svchost.exe.

Typically, the longer malware remains in the system, the more mechanisms it has to maintain access. Therefore, after removal, it's important to conduct a comprehensive scan of the device.
Even after removing spyware, the job isn't complete. If spyware has managed to collect user data, the consequences may appear weeks or even months after the device is cleaned. Therefore, after eliminating the threat, it's important to take additional security measures.

First and foremost, we recommend:

• change passwords for all important accounts;
• enable multi-factor authentication;
• terminate active sessions on all devices;
• check your account login history;
• analyze banking operations;
• update the operating system and applications;
• check backups for suspicious files.

These measures help protect accounts, but they're not the only way to recover from an incident. There are also less obvious steps that can help prevent a repeat breach.

Modern spyware isn't a virus that accidentally lands on a device. Its purpose is to legitimize itself, remain undetected, and operate for years.

Removing spyware is only the first step. Simply deleting an app or file leaves a high risk of re-compromise. It's important to assume that the attacker may have already gained access to passwords, tokens, active sessions, email, instant messaging, cloud services, and corporate accounts.

After wiping the device, it's important to change passwords from a trusted device, end all active sessions, reissue access tokens, check linked devices, and update the OS and apps. For work accounts, it's worth additionally reviewing login logs, email forwarding rules, and permissions granted to third-party apps.

On Windows, check startup, task scheduler, WMI subscriptions, services, and browser extensions. On Android, check the list of apps, granted permissions, device administrator rights, Accessibility access, and installation of apps from unknown sources. If there are signs of a targeted attack, especially against an employee with access to sensitive data, it's safer to perform a full reset of the device and restore only verified data. In this situation, simply deleting the suspicious app is no longer sufficient.
Click to expand...

Experience shows that it is errors during the recovery stage that most often lead to re-infection or compromise of accounts.
After detecting spyware, many users focus solely on removing the malware. However, this approach fails to address the consequences of the attack. The most common mistakes include:

• refusal to change passwords;
• lack of multi-factor authentication;
• recovering data from an infected backup;
• ignoring system updates;
• using the same device without additional verification;
• saving suspicious applications "just in case".

Such actions significantly increase the risk of repeated compromise and data leakage.
Most spyware attacks can be prevented by following basic digital hygiene practices:

• install applications only from official sources;
• update your operating system regularly;
• control application permissions;
• use multi-factor authentication;
• do not open suspicious attachments and links;
• check the list of connected devices in accounts;
• use modern security solutions;
• Create regular backups of important data.

App permissions deserve special attention. Even a legitimate app doesn't always need access to the microphone, camera, or geolocation. The fewer privileges an app receives, the less potential damage it could suffer if compromised.
In 2026, spyware increasingly exploits legitimate system mechanisms and remains undetected for long periods of time. Therefore, reliable protection is no longer limited to running an antivirus.

Regularly monitoring application permissions, network activity, autostart mechanisms, and account security is far more important. A combination of automatic protection and manual scanning allows for early threat detection and the minimization of the consequences of a compromise.