How stalkerware hides from its victim, and from antivirus

Why the volume matters

Stalkerware is software that lets a remote user monitor a device without that user’s consent and without explicit, persistent notification, in the definition of the Coalition Against Stalkerware[S5]. Kaspersky reported a multi-year total of affected users, newly seen families and users in well over a hundred countries. These are one vendor’s users and so a floor[S3]. TechCrunch’s running tally lists many stalkerware-type companies hacked or leaked since 2017, several of which shut down[S4].

A longer view shows how hard the trend is to read. Kaspersky counted unique users affected each year: a high in 2019, then a lower and fairly steady count through 2023, across well over a hundred countries[S7]. Those are detections of apps meeting the Coalition’s criteria among one vendor’s customers. A fall in the count can mean fewer victims, more successful hiding, or a changed customer base. The definition also excludes dual-use parental and anti-theft apps and commercial spyware sold to governments, so the figure answers a narrower question than its headline suggests.

What the Cambridge study found

Researchers at the University of Cambridge Computer Laboratory compared 82 Android stalkerware builds from 2012 to 2025 across four long-running families, collected from Google Play, vendor sites and modified app markets[S2]. Their findings are specific.

Builds distributed outside the official store keep targeting old versions of Android’s programming interfaces to preserve invasive features. Builds on the store use what the study calls "malicious compliance": they meet the letter of the rules with obfuscated notifications. Some use a split-app model, in which a compliant viewer app pairs with a full-featured app installed from outside the store. And every family converged on two techniques: Accessibility Services, to read the screen and log keystrokes, and boot receivers, to restart whenever the phone does[S2].

What platform changes did and did not stop

Android has tightened several things over the years: foreground-service notifications in Android 8, service types in Android 10, a restriction on listing all installed packages in Android 11, approximate location in Android 12 and split media permissions in Android 13. The study’s reading is that these changes displace abuse rather than eliminate it[S2].

Our assessment is that this is the central lesson. The platform narrows one door and the apps move to the next. Accessibility rights exist for people who need them, so they cannot simply be removed; a monitoring app that obtains them looks, to the system, like an assistive tool.

The test: what security products did

AV-Comparatives and the Electronic Frontier Foundation tested 13 Android security products against 17 sideloaded stalkerware test cases on a non-rooted Samsung Galaxy A36 running Android 15[S1]. Detection ranged from 100 percent for the top-scoring product to 94 percent for a group of four and 53 percent for Google Play Protect, the platform’s built-in protection[S1].

The scores are not the most important result. The report found that most alerts were generic, none removed the app automatically, most advised immediate removal without warning that removal could alert the abuser, and none used a secure notification channel[S1].

Our assessment: why a warning can be a hazard

A security product that detects stalkerware and shows a loud, generic alert has done what it was built to do and may still have made things worse. If whoever is monitoring the phone sees the app vanish, or sees the alert through the app’s own access to the screen, the response can be escalation. Detection without safety planning is therefore not the same as protection.

Network-based blocking is also weaker than it sounds. In one reported case the service stored victims’ photos and ambient audio in a Google Firebase backend, so the phone’s outbound traffic went to Google endpoints and domain blocklists would have little to catch[S6]. We read this as a reason to inspect the app itself, not only the traffic.

What a phone shows

The study lists signals a defender can use. An app that holds the right to bind as an accessibility service, to start at boot, to draw over other apps, or to act as a device administrator is one to look at, particularly if it also reads messages and call logs or can use the camera, microphone or location, and has no launcher icon[S2]. Other signals are generic, system-style labels, a persistent notification disguised as something routine, a store-installed viewer beside a non-store package, and, on Android 13 and later, separate grants for photos, videos and audio that show what the app can read[S2].

A grant shows capability, not use. Most apps that hold camera or microphone rights are legitimate, and a permission request is not evidence of misuse. We publish detection signals only, not steps for evading them.

Our reading of the study adds one point. Each signal is weak on its own and strong in combination. An accessibility service on a screen reader is normal; the same right on an app with a system-style label, no launcher icon and a boot receiver is not. The case for looking at permissions together, rather than one at a time, comes from how these apps are built.

What the Lab is watching

We are watching whether platform makers add a secure, owner-only way to surface a detection, since the test found none did. We are also watching the vendor-breach record: breaches expose purchasers, not victims’ content, and a leaked purchaser list can identify people who are innocent or lawful parents. It is not a tool for private searches.

What this means for examiners

If a client may be monitored, put safety first. Do not remove the app, change passwords or confront anyone before the individual has a plan and a safe device or contact; removal can alert whoever installed it. Involve a victim-support organization. Write down which device and which accounts the client uses, and which of them the other person has ever had access to, because the order of steps depends on that list.

How it reaches a phone and what it leaves: propagation needs physical access or a lure at some point; the format is an app, often two; traces are permission grants, boot-start entries, administrator lists and install records; the phone’s own retention limits what is left.

If you think a phone is being monitored

Do not remove anything yet. Use a different, trusted device to reach a victim-support organization, and plan the order of steps before you change anything on the phone itself.